THE REFERENCE SHELF
A little less jargon.
Plain-language definitions, with the context that makes them useful.
- TLS
- Transport Layer Security is the protocol used to protect a connection between a client and server. It provides encryption, integrity and authentication mechanisms. It does not by itself guarantee that a website’s content or business is trustworthy.
- SSL
- Secure Sockets Layer is the older protocol name still used in everyday phrases such as “SSL certificate.” Modern HTTPS uses TLS; a familiar label should not be mistaken for a recommendation to enable obsolete SSL protocols.
- HTTPS
- HTTP carried over a TLS-protected connection. It protects traffic in transit between the relevant endpoints. A CDN or reverse proxy can mean there is more than one connection to consider.
- Certificate
- A signed statement binding a public key to an identity such as a website hostname, within a stated validity period. A client must check more than the mere presence of a certificate before trusting the connection.
- Certificate authority
- An organization or system that issues certificates under a defined policy. Publicly trusted certificates participate in trust arrangements recognized by browsers and other clients; privately managed trust has a different scope.
- Private key
- The secret cryptographic key corresponding to a public key. It must remain protected. Do not paste it into a public checker, article comment, support forum or chat to diagnose a certificate problem.
- Subject Alternative Name
- A certificate extension that identifies names or identities covered by the certificate. A hostname mismatch can occur when the requested name does not match the certificate presented by the endpoint.
- Certificate chain
- The relationship between a server certificate and issuing certificates leading toward a trust anchor recognized by the client. Missing intermediates and client trust-store differences are distinct possibilities when diagnosing a chain issue.
- ACME
- The Automatic Certificate Management Environment protocol supports automated certificate management. An ACME client coordinates the protocol; deployment and checking what the web server actually serves still need attention.
- Validation challenge
- A step used to demonstrate control over an identifier when requesting a certificate. Different challenge types have different networking, DNS and access requirements. Use the CA and client’s documentation for the actual workflow.
- Renewal
- The process of obtaining a replacement certificate and ensuring it is deployed successfully. A newly issued file is not proof that every relevant endpoint is serving the replacement.
- SNI
- Server Name Indication lets a client indicate the intended hostname during a TLS handshake. It helps an endpoint serving several sites select the appropriate configuration and certificate.
- Mixed content
- An HTTPS page can still request some resources using HTTP. That creates a separate problem from certificate validity; inspect the actual resource URLs and browser diagnostics rather than treating every warning as a certificate failure.
- HSTS
- HTTP Strict Transport Security is a browser-facing policy telling a browser to use HTTPS for a site. It has operational consequences, particularly for subdomains and preload choices, so it should be introduced deliberately.
- Revocation
- A way to indicate that a certificate should no longer be trusted before its normal expiry. Reasons can include a compromised key or incorrect issuance; the relevant CA’s procedures and client behavior matter.
- Certificate monitoring
- Checks that help an operator notice problems such as an approaching expiry or an unexpected served certificate. Monitoring is one part of operations, not a guarantee that a website is secure.
Keep learning in context
Read the practical map of HTTPS, TLS and certificates or choose a learning path. For primary references, see MDN’s TLS guidance and Let’s Encrypt documentation.