PlayInfoBox

Home /Network /SSL/TLS Certificates Explained: How the Padlock Actually Works

SSL/TLS Certificates Explained: How the Padlock Actually Works

The padlock icon in your browser represents a specific chain of cryptographic trust. Here is what is actually inside it.

A certificate is a signed data structure, not just a key

An SSL/TLS certificate follows the X.509 standard and bundles a public key together with metadata: the domain it covers, the issuing authority, a validity window, and a digital signature from the issuer. The private key that pairs with the public key never leaves the server.

Trust flows down a chain, not from a single file

A server certificate is signed by an intermediate certificate authority, which is itself signed by a root CA that ships pre-installed and trusted in your browser or OS. Your browser walks this chain back to a trusted root before it shows the padlock.

DV, OV, and EV differ in vetting, not encryption strength

Domain Validated (DV) certificates only confirm you control the domain, issued in minutes. Organization Validated (OV) and Extended Validation (EV) require verifying the legal business behind the site, taking longer to issue. All three encrypt the connection equally well.

Viewing a certificate takes one click

Clicking the padlock or site-information icon in the address bar and opening "Certificate is valid" (Chrome) or "Show Certificate" (Safari) reveals the issuer, validity dates, and the full trust chain for any site you visit.

"SSL" is the old name people kept using

SSL was deprecated over a decade ago in favor of TLS, which is more secure and is what every modern site actually uses. The term "SSL certificate" stuck around in everyday use even though the protocol running underneath is TLS.

Why the chain matters more than the padlock itself

The padlock only confirms the connection is encrypted and that some certificate authority vouched for the domain β€” it says nothing about whether the site itself is trustworthy or legitimate. Scam sites can and do hold valid DV certificates, since domain validation checks control of a domain, not the intent of whoever controls it.

Why EV certificates faded from browser UI

Browsers used to show a green company name next to the padlock for EV certificates, but most major browsers removed that distinct visual treatment because research suggested it did not meaningfully help users spot scams, and displaying it inconsistently across sites created more confusion than clarity.

Frequently Asked Questions

Does HTTPS mean a site is safe to trust?

It means the connection between you and the site is encrypted and the certificate is valid for that domain β€” nothing more. It says nothing about whether the site itself is legitimate, so phishing sites frequently use valid HTTPS certificates too.

What happens when a certificate expires?

Browsers block the site with a warning page until the certificate is renewed, since an expired certificate can no longer be trusted to prove the connection is genuinely secure. Most sites now automate renewal specifically to avoid this happening.