How SSL Certificates Work: Chains of Trust and Why Yours Expired

Every site owner takes it for granted that their SSL certificates will keep working without a hitch. However, when one of those little digital seals expires or gets messed up, the consequences can be disastrous. Outages caused by expired SSL certificates are all too common and can leave your visitors seeing scary warning screens and losing trust in your site.

At its core, an SSL certificate is just a signed statement that ties a public key to a specific domain name. It doesn't verify the site's operator or the quality of the site; it's simply a way for browsers to check that they're connecting to the right place. The certificate is signed by a trusted Certificate Authority (CA), which gives browsers something to compare against their internal list of trusted CAs.

Inside an X.509 certificate, there are several key pieces of information: the domain name (subject), the issuing CA (issuer), the validity period, the public key, the list of alternative names the certificate applies to, and the CA's digital signature. Modern browsers ignore the old "Common Name" field for hostname matching and instead rely on the Subject Alternative Name (SAN) list.

The real magic happens when you look at the entire chain of trust. A single domain certificate is just one link in a chain that leads back to a trusted root CA. This root CA is pre-installed in your browser or device and never changes. The intermediate CA sits between the root and the leaf certificate (your domain certificate), which is what actually gets installed on your server.

So why do we need this complex chain of trust? The main reasons are security and containment. By using multiple intermediates, the root CA's private key can stay offline and safe. If an intermediate CA is compromised, you can revoke just that one intermediate without having to invalidate every certificate that trusts it.