What are Digital Certificates?
Learn what digital certificates are, their fields, DV/OV/EV levels, and how browsers validate them — with interview Q&A.
Expected Interview Answer
A digital certificate is an electronic document, typically in X.509 format, that binds a public key to an identity (such as a domain name or organization) and is digitally signed by a Certificate Authority, allowing anyone who trusts that CA to verify the identity behind the key without meeting the owner directly.
A certificate contains the subject's identity, the subject's public key, the issuing CA's identity, a validity period (not-before/not-after dates), and a digital signature from the CA over all of that data — the signature is what lets a relying party detect if any field has been tampered with, since altering even one byte would invalidate the signature. When a browser connects to an HTTPS site, the server presents its certificate; the browser checks that the domain matches, that the current date falls within the validity window, that the signature chains up to a trusted root CA, and that the certificate has not been revoked. Certificates come in a few trust levels — Domain Validated (DV) only proves control of the domain, Organization Validated (OV) additionally verifies the requesting organization is real, and Extended Validation (EV) requires the most rigorous vetting — though modern browsers give all three similar visual treatment. Because the certificate only proves “this public key belongs to this verified identity,” the actual encryption of traffic still relies on the private key that corresponds to that certificate's public key never leaving the server.
- Cryptographically binds a public key to a verified identity
- Signature lets any relying party detect tampering with the cert data
- Enables trust without a prior direct relationship (via the issuing CA)
- Underpins HTTPS, code signing, and client/mutual TLS authentication
AI Mentor Explanation
A digital certificate is like an official player accreditation card issued by the cricket board — it states the player's name, their squad, an expiry date, and it carries the board's tamper-evident hologram (the signature) so a security guard at the gate can trust it without knowing the player personally. If anyone tries to alter the name printed on the card, the hologram pattern breaks and the forgery is obvious. The card only proves who the player is, not that they will bat well that day — the same way a certificate proves identity, not the quality of what happens over the connection.
Step-by-Step Explanation
Step 1
Fields bound together
A certificate packages the subject identity, its public key, the issuer, and a validity period.
Step 2
CA signs the data
The issuing CA computes a digital signature over that data, sealing it against tampering.
Step 3
Presented on connect
A server presents its certificate during the TLS handshake when a client connects.
Step 4
Client validates
The client checks the domain match, validity dates, signature chain to a trusted root, and revocation status.
What Interviewer Expects
- Defines a certificate as identity + public key + CA signature
- Explains what fields it contains (subject, issuer, validity, signature)
- Knows how a client validates a certificate on connection
- Distinguishes DV/OV/EV validation levels
Common Mistakes
- Thinking the certificate itself encrypts the traffic (the paired private key + session key do)
- Confusing certificate validity dates with revocation status
- Not knowing the signature covers the whole certificate, detecting any tampering
- Assuming EV certificates get meaningfully different browser UI today
Best Answer (HR Friendly)
“A digital certificate is like a verified ID card for a website or server — it proves that a specific public key really belongs to a specific, verified identity, because a trusted Certificate Authority checked and signed it. When your browser connects to a site over HTTPS, it checks this certificate to make sure it is really talking to the right server and that nobody has tampered with its details, before any private data is exchanged.”
Code Example
# View the certificate a live HTTPS server presents
openssl s_client -connect example.com:443 </dev/null 2>/dev/null | openssl x509 -noout -text
# Check the subject, issuer, and validity dates of a cert file
openssl x509 -in server.crt -noout -subject -issuer -datesFollow-up Questions
- What is the X.509 format and what fields does it define?
- What is the difference between DV, OV, and EV certificates?
- How does a client detect if a certificate has been tampered with?
- What happens when a certificate expires versus when it is revoked?
MCQ Practice
1. What does a digital certificate primarily bind together?
A certificate binds a public key to a verified identity, signed by a trusted CA.
2. What allows a relying party to detect tampering with a certificate?
The CA's signature covers the whole certificate; altering any field invalidates the signature.
3. Which validation level only proves control of the domain, not organizational identity?
DV certificates only verify domain control; OV and EV add organizational identity checks.
Flash Cards
What is a digital certificate? — An X.509 document binding a public key to a verified identity, signed by a CA.
What fields does it contain? — Subject identity, public key, issuer, validity period, and the CA's signature.
How is tampering detected? — The CA's signature over the certificate data breaks if any field is altered.
DV vs OV vs EV? — DV proves domain control only; OV verifies the organization; EV requires the most rigorous vetting.