The certificate and the certification authority

A certificate is a document that links a domain name to a public key, and which has been signed by someone.

What it contains

Subject      : exemple.com
Public Key   : 30 82 01 0a 02 82 01 01 00 c3 ...
Issuer       : Example CA X3
Validity     : 2026-01-15  ->  2026-04-15
Signature    : 5f 2a 91 ...

These headings are in English because they are those used in the format itself: you’ll find them exactly as they are when you open a certificate in your browser.

The format is called X.509. The key element is the signature: the certificate authority has calculated a hash of all the other data and signed it with its private key.

Verification

Your browser verifies this signature using the certificate authority’s public key, which it already holds. If the signature is valid, the browser knows that the certificate authority did indeed issue this certificate and that nobody has altered it since.

Note that the certificate is not secret. It is sent in plain text to anyone who connects. Possessing it proves nothing — remember the CertificateVerify message, which requires the private key.

How it’s obtained

The certificate authority must verify that you do indeed control the domain. In practice, it asks you to publish a specific value in a location that only the owner can modify:

• a file at a specific address on the site;
• or a specific DNS record.

This is what the ACME protocol—used by Let’s Encrypt, which has made certificates free and automatic—automates.

Validation levels

There are three levels, and the distinction is less useful than one might think:

• DV (domain validation): domain verification only. This applies to almost all certificates;
• OV (organisation validation): a few checks on the organisation;
• EV (extended validation): in-depth checks.

Browsers used to display a green bar for EV certificates. They have removed it: studies have shown that nobody noticed it, and that its presence did not influence decision-making in any way. Today, all three levels display the same padlock icon.