Digital certificates establish a secure connection by authenticating a server and linking its identity to a verified public key. The client then uses this trust as part of the TLS handshake that creates encrypted communication.
How the mechanism works
-
The server sends its digital certificate. When a client connects to a website using HTTPS, the server provides a certificate containing its domain name, public key, validity period, issuer, and digital signature.
-
The client verifies the certificate. The browser or operating system checks that the certificate:
- matches the requested domain;
- is within its validity period;
- has not been revoked;
- was signed by a trusted certificate authority (CA).
-
The CA's signature is checked. The client uses the CA's public key to verify the certificate's digital signature. A successful check confirms that the certificate has not been altered and that the CA authenticated the certificate holder.
-
The server proves possession of its private key. In modern TLS, the server signs handshake data using the private key corresponding to the certificate's public key. This prevents an attacker from successfully using a copied certificate without the private key.
-
Session keys are established. The client and server complete a key exchange and derive shared symmetric session keys. These keys encrypt and authenticate the data transmitted during the session because symmetric encryption is efficient for large amounts of data.
A common misconception is that the digital certificate itself encrypts all transmitted data. It does not. The certificate authenticates the server and its public key; the TLS handshake establishes the session keys that protect the actual communication.
Exam technique
For an IB Computer Science explanation, clearly separate authentication from encryption. A complete answer should mention the CA's signature, certificate validation, proof of private-key possession, session-key establishment, and encrypted communication. Avoid stating only that a certificate “proves a website is safe” because this does not explain the security mechanism.
