Certificates, Explained

This post is about HTTPS (X.509) certificates used on the web1. It has two parts: Certificates explained without cryptography Certificates explained with cryptography The explanation with cryptography depends on the explanation without cryptography, so you’ll want to either read both, or only read Part 1. Certificates and certification authorities, explained without cryptography Websites use certificates to prove that they’re the “real” website2, and not an imposter. The certificate is used to bootstrap a secure connection between the browser and website that cannot be read, modified, MITM’d, or intercepted by an attacker, who could then read and exfiltrate data sent between the user and the website, such as passwords, messages, and financial or health information. A certification authority (CA) issues certificates to websites.