What Is Digital Certificate?

A digital certificate binds a public key to an identity, signed by a certificate authority whose signature the relying party trusts. It is the artefact that makes public key cryptography usable at scale, because it answers the question a bare key cannot: whose key is this?

What validation actually checks

A relying party verifies several things, and implementations have historically got each of them wrong at some point. That the signature chains to a trusted root. That the certificate has not expired. That it has not been revoked. That the name matches what was requested. And that it is being used for a purpose it was issued for.

Name validation is the one most often weakened. Accepting a certificate whose name does not match the host being contacted removes the entire authentication property while leaving the encryption in place — which is exactly what an interception attack needs.

Revocation has never worked well

Certificates can be revoked before expiry, and the mechanisms for communicating that have significant practical limitations. Revocation lists grow large; online status checks add latency and a privacy concern, and clients frequently proceed when the check fails rather than blocking.

The practical response has been shorter lifetimes. A certificate valid for weeks rather than years limits the window during which revocation would matter, which is why automated issuance and renewal have become the norm.

Inventory is harder than it sounds

Certificates accumulate across load balancers, web servers, application servers, appliances, internal services, code signing and client authentication. They are issued by different teams, from different authorities, with different lifetimes, and no single system holds the list.

The consequences arrive as outages: an expired certificate on a system nobody realised had one, discovered when a service stops working. Discovery tooling that scans the estate for certificates and tracks expiry is the practical answer, and the first scan invariably finds certificates nobody knew existed.

Ownership matters as much as the inventory. A certificate with an expiry date and no owner will expire.

Private keys are the part that actually matters

A certificate is public information. The private key it corresponds to is what proves identity, and its protection is frequently weaker than the ceremony around certificate issuance suggests.

Keys are found in configuration directories with permissive access, copied between environments during troubleshooting, committed to repositories, and included in backups protected less carefully than the systems themselves.

Where the certificate secures something consequential — code signing especially — hardware-backed key storage with signing performed as a service removes the possibility of the key existing as a file anyone can copy.

The thing most worth getting right

Where to start

Inventory your certificates with their expiry dates and confirm which renew automatically. The manually renewed ones are your future outages, and they are usually the ones nobody remembers owning.

See TLS. GuardsArm runs security program reviews.