Certificate Concepts

Chains of trust, CSRs, SANs, key usage, mTLS, revocation — the ideas behind the commands.

• Certificate signing requests

  A CSR proves you hold a private key and states the identity you want certified. The CA decides what the certificate actually says.

• The certificate chain of trust

  Why your certificate alone is not enough, what the server must send, and why browsers succeed where curl fails on the same misconfigured host.

• Self-signed vs CA-signed certificates

  Both provide identical encryption. The difference is entirely about who vouches for the identity, and that difference decides how much work you are signing up for.

• Free TLS certificates and ACME

  Every publicly trusted certificate you can get for nothing comes out of ACME. What the protocol does, which CAs offer it, and the cases where free is the wrong answer.

• Subject Alternative Names

  The extension browsers actually match hostnames against. The Common Name has been ignored since Chrome 58, which is why CN-only certificates fail everywhere.

• Wildcard certificates

  A wildcard replaces exactly one label, never two, and never the bare domain. What that means in practice, how to get one, and when a multi-SAN certificate is the better choice.

• Root and intermediate certificate authorities

  Roots are trust anchors kept offline; intermediates do the actual signing. That split is why a compromised CA does not require an operating system update.

• Mutual TLS

  In mTLS the client presents a certificate too, so both ends authenticate. Here is what changes on each side and what usually breaks.

• Key usage and extended key usage

  Two extensions that both restrict what a certificate can do, at different levels. Getting either wrong produces "unsupported certificate purpose".

• Revocation — OCSP and CRLs

  Both answer "has this certificate been revoked?". Neither works reliably in browsers, which is why certificate lifetimes keep shrinking instead.

• Certificate fingerprints

  A hash of the certificate's DER bytes. Unchanged by PEM/DER conversion, changed by any reissue — which is what makes pinning brittle.