Skip to main content
MI Support IT logo

IT security

What is a digital certificate?

A digital certificate binds a public key to an identity and is signed by a CA. See what certificates are used for, and why expiry is critical.

In short

A digital certificate is an electronic file that binds a public cryptographic key to an identity, such as a domain, a person or a machine, and that is signed by a trusted Certificate Authority (CA).

Certificates are the foundation of secure communication on the internet: they prove that your web server, email sender or device is who it claims to be, and they enable encrypted connections via TLS/https. Companies also use them for email signing, client and machine identity, and document signing.

The key points are that a certificate is only trustworthy because a CA vouches for it, that it always has a limited lifetime, and that expired certificates are one of the most frequent causes of sudden outages. That makes visibility and renewal the main practical task. MI Support IT has many years of specialist experience with PKI and helps Danish businesses keep certificates under control, from issuance to automated renewal.

Back to the glossary

What is a digital certificate?

A digital certificate is an electronic file that binds a public key to an identity and confirms the link with a signature from a trusted Certificate Authority (CA). When your browser shows the padlock on an https connection, it is a certificate proving that the server actually belongs to the domain it claims. The certificate is therefore not the encryption itself, but the proof of identity that makes the encryption trustworthy.

Certificates are the building blocks of a PKI (Public Key Infrastructure). The PKI is the whole infrastructure behind them: CAs, policies, issuance and revocation. The certificate is the concrete product that infrastructure delivers.

What does a certificate contain?

A certificate follows the X.509 standard and in practice contains three things:

  1. The public key, which counterparties use to encrypt data to you or verify your signatures.
  2. Identity information: domain name, organisation name, email address or machine name, depending on the certificate type.
  3. The CA's signature plus metadata such as validity period, serial number and intended usage.

The corresponding private key is not in the certificate. It must be stored securely on your side, for critical keys preferably in an HSM. Microsoft's documentation on Microsoft Learn describes the format and fields in detail.

What types of certificates exist?

For TLS/https, a distinction is made between validation levels: DV (Domain Validation) only proves control of the domain, OV (Organization Validation) also confirms the company behind it, and EV (Extended Validation) requires the most thorough checks. Technically they encrypt identically; the difference is how much identity the CA has verified.

In addition, companies use S/MIME certificates for signing and encrypting email, client certificates to identify users and machines to networks and systems, document signing certificates for legally binding signatures, and certificates for code signing of software.

Why do certificates expire, and what happens then?

All certificates have a limited validity, typically a year or less for TLS. This is a security mechanism: shorter lifetimes limit the damage from leaked keys and force the details to be revalidated regularly. The consequence is that renewal is a recurring operational task, and a missed expiry hits hard: browsers block the site with a warning, API calls fail, and mail flows stop. We have described the whole journey from ordering to renewal under the TLS certificate lifecycle, and with ACME renewal can be fully automated. If you want to dive deeper, we have gathered it all in the e-book PKI and HSM in practice.

How MI Support IT helps

We have many years of specialist experience with PKI and certificate management in Danish businesses, from the complete overview of your certificates to automated renewal and secure key storage. Read more under PKI Management, or contact us for a concrete conversation about your certificate landscape.

Shall we talk about your business and your needs?

Real people talking to real people. We get back to you the same day.

Write to usBook a meeting