How SSL Certificates Work: Chains of Trust and Why Yours Expired

A certificate is a signed statement binding a public key to a domain name. That's the whole claim. The signature comes from a certificate authority already present in the client's trust store, and everyone calls these SSL certificates even though the artifact is X.509 and the protocol is TLS.

The fields that matter in practice are subject, issuer, validity window, public key, and the Subject Alternative Name list. Modern browsers match hostnames against SAN and ignore Common Name completely, which trips up anyone who learned this years ago. Certificates chain from a leaf up through intermediates to a self-signed root, and intermediates exist so the root key can stay offline and a compromise can be contained. Your server has to send the leaf plus intermediates but not the root, and omitting an intermediate produces the classic bug that works in your browser and fails in curl.

Revocation is the weak link: soft-fail checks mean an attacker who blocks them wins, so automate renewal and the reload, then alert on expiry as a metric.