Mobile Networking · Encryption in Transit · Lesson 2 of 4

Certificates & Trust

Learn who vouches for a website and how your phone decides whom to believe.

The Chain of Trust

A certificate is a small file that ties a domain name to a public key. It lists the name it covers, who issued it, and the dates it's valid. It also carries the issuer's digital signature, which anyone can check and nobody else can forge.

The issuer is a certificate authority (CA), an organization trusted to confirm that whoever asks for a certificate really controls that domain. Most sites get their certificate from an intermediate CA, which was itself signed by a higher CA. That sequence is called the chain of trust.

The top of the chain is the root certificate. Your phone ships with a list of roots it trusts, called a root store. Apple maintains one for iPhones, and Android has its own, refreshed through system updates. Some browsers, such as Firefox, keep their own list as well.

When a site's chain leads back to a root in that list, the browser accepts it. The Free WiFi Portal CA from the last lab isn't in any root store, so its certificate failed the check and you saw the warning.

Expiry, Warnings and Extra Roots

Browsers reject a certificate for a few common reasons. It might have expired. It might be for a different name than the one you visited. Or its chain might not lead to a trusted root. Each one triggers a warning page.

Expiry happens on purpose. Browser makers and CAs set a maximum lifetime through a group called the CA/Browser Forum. Under rules passed in 2025, the limit dropped from 398 days to 200 days in March 2026, and it shrinks in steps to 47 days by 2029. Short lifetimes limit the damage if a certificate's key is stolen.

You can also add a root to your phone yourself, usually through a configuration profile. Workplaces do this for internal sites, and security testers do it on their own test phones to inspect traffic, as you'll see in Course 3. An iPhone makes you switch on full trust for a manually installed root in Settings. Most Android apps built for Android 7 or later ignore user-added roots unless the app opts in.

An extra root can vouch for any site at all, so only install one you fully trust.