Network guides
SSL/TLS Certificates Explained: Trust Chains and the Most Common Errors
When you connect to a website over HTTPS, a small cryptographic file called an SSL/TLS certificate is what turns the padlock icon from a warning into a reassurance. It proves two things: that the site you are talking to really is the site you intended to visit, and that the data exchanged between your browser and the server is encrypted so that eavesdroppers cannot read it.
But a certificate is not a single object. Each one is part of a chain of trust that starts with a root Certificate Authority, passes through one or more intermediate authorities, and ends at the leaf certificate installed on the server. Understanding this chain, and how to verify it, is the key to diagnosing the most common HTTPS errors.
-
1994
Netscape launches SSL
The first Secure Sockets Layer protocol is introduced with early browsers, making encrypted web connections possible for the first time.
-
1999
TLS replaces SSL
The Transport Layer Security protocol, the modern successor to SSL, is standardized and gradually becomes the default for secure browsing.
-
2008
TLS 1.2 arrives
A major revision strengthens the cryptographic algorithms and becomes the backbone of secure internet traffic for over a decade.
-
2018
TLS 1.3 modernizes encryption
The latest version removes obsolete algorithms, reduces handshake latency, and keeps connections fast and private.
What a certificate actually does
An SSL/TLS certificate is a digital document issued by a trusted third party, the Certificate Authority (CA). It binds a public key to an identity, usually a domain name, and is signed by the CA so that anyone can check it was not tampered with. When your browser connects over HTTPS, the server presents its certificate during the TLS handshake.
That certificate does two jobs. First, it proves the identity of the server: the public key inside it lets the browser verify that the hostname it requested really belongs to the server it reached. Second, it enables encryption: the browser and server use that public key to negotiate a shared secret, then encrypt all traffic with it. Without a valid certificate, the browser flags the site as insecure or blocks the connection.
The chain of trust: root, intermediate and leaf
Certificates rarely stand alone. A leaf certificate is the one installed on your web server and presented to visitors. It is signed by an intermediate certificate, which in turn is signed by a root certificate belonging to the CA. This hierarchy is called the chain of trust, and it exists so that the root key - the most sensitive one - is used as rarely as possible.
When a browser validates a site, it walks up the chain from the leaf certificate to the intermediate and finally to a root certificate that is pre-installed in its trust store. If any link in the chain is missing, expired or invalid, the whole verification fails, even if the leaf certificate itself is perfectly formatted.
How to verify a certificate
The browser checks three things. First, the validity period: a certificate is only trustworthy between its not-before and not-after dates. Second, the hostname: the certificate must cover the exact domain requested, either in a Common Name or in the Subject Alternative Name (SAN) field, which is why a certificate for example.com fails on www.example.com unless both are listed.
Third, the chain must be complete and the signatures valid. When a server hosts multiple sites, the correct certificate is selected using SNI (Server Name Indication), which tells the server which hostname the client wants. Tools like openssl s_client can dump the full chain, expiry and SAN list in one command, making manual verification straightforward.
Common errors and what they mean
The most frequent certificate errors are easy to interpret once you know the chain. Unknown host or name mismatch means the certificate covers a different domain than the one requested - a common misconfiguration when a certificate is reused across sites. Self-signed means the certificate was signed by itself rather than a trusted CA, which is fine in a lab but a red flag on a public site.
Expired or not yet valid means the certificate is outside its validity window, usually because a renewal was missed. For a website, any of these errors can scare visitors away or cause clients to refuse to connect. Monitoring the expiry date, keeping the chain complete, and renewing before the deadline are the essential habits that keep HTTPS working.
要点总结
A certificate is only as trustworthy as the chain behind it. Understanding how roots, intermediates and leaves fit together turns cryptic browser warnings into actionable fixes, and helps you keep every connection encrypted and verifiable.