Browsers & Accounts · HTTPS & Certificates · Lesson 1 of 5

Reading a Certificate

See what a site's certificate proves, and what it can't tell you.

What a certificate proves

In Staying Safe Online, you learned that the padlock means your connection is scrambled. Now let's look at the paperwork behind it.

HTTPS is the secure way a browser talks to a website. The S stands for secure.

A certificate is a small digital ID card that a website shows your browser. It says which web address it belongs to. Your browser checks it every time you open a site that uses HTTPS.

Who hands out these ID cards? A certificate authority is a company trusted to check that a site really controls its address before giving it a certificate. Your computer and browser come with a list of authorities they trust.

When the check passes, the certificate proves one main thing. You are talking to the real owner of that exact address, and nobody in between can read along.

To see it yourself:

• In Chrome, click the small icon to the left of the address. Then choose Connection is secure, then Certificate is valid.
• In Edge, Safari and Firefox, click the padlock and look for the certificate details.

The details show three useful things:

• Issued to: the web address the certificate is for.
• Issued by: the certificate authority that checked it.
• Valid from and to: the dates it works. Most certificates last only a few months. Then the site gets a fresh one.

You don't need to check this on every site. Your browser does it for you. But knowing where to look helps when something feels off.

On the practice computer, click the padlock on bank.example and view its certificate. Check who it's issued to. Then open the other site, read the warning and choose Go back.

What a certificate can't tell you

A valid certificate is good news. But it only answers one question: is this really the site at this address?

It does not answer a different question: is this site honest?

Here's why. A basic certificate is free and quick to get. The certificate authority mainly checks that the person asking controls the address. It usually doesn't check who they are, or whether their business is real.

So a scammer can buy an address like bank-secure-login.example and get a real certificate for it in minutes. Their fake page shows a padlock, just like your bank does.

The certificate isn't lying. You really are connected to bank-secure-login.example. That just isn't your bank.

Think of it like a name tag. It proves the name is spelled right. It doesn't prove the person wearing it is kind.

What a certificate does protect:

• Others on the same Wi-Fi can't read what you send or see.
• Nobody can quietly change the page on its way to you.
• You reach the real owner of the address in the address bar.

What it doesn't protect:

• You from a fake site with its own address.
• You from a real site that sells poor products or shares your data.
• Your information after the site receives it.

So the padlock is where checking starts, not where it ends. Always read the site's name in the address bar too. The next modules show you how to spot trouble when the name or the certificate is wrong.