The 9 fields and concepts you'll meet in the response — defined in plain English, each with a real example value.
Secure Sockets Layer—the original protocol for encrypted web connections, now succeeded by TLS.
SSL was developed by Netscape in the 1990s. SSL 2.0 and 3.0 are obsolete and have known vulnerabilities. The term "SSL certificate" persists even though modern certificates use TLS. Today, "SSL" is often used interchangeably with "TLS" in casual usage.
ExampleSSL 3.0 is deprecated; use TLS 1.2 or 1.3
Transport Layer Security—the modern protocol for encrypted connections, successor to SSL.
TLS provides encryption, authentication, and data integrity for network connections. TLS 1.2 and 1.3 are current standards. TLS 1.3 offers better security and performance. The TLS version is negotiated during the connection handshake.
ExampleServer supports TLSv1.2 and TLSv1.3
HTTP Secure—HTTP traffic encrypted with TLS, indicated by https:// URLs.
HTTPS wraps HTTP traffic in TLS encryption. It protects data from eavesdropping and tampering. Search engines favor HTTPS sites. Modern browsers warn when submitting forms over plain HTTP. HTTPS requires a valid SSL/TLS certificate.
Examplehttps://example.com uses encrypted connection
An organization trusted to issue digital certificates that verify website identity.
CAs verify domain ownership or organization identity before issuing certificates. Major CAs include DigiCert, Let's Encrypt, Comodo, and GlobalSign. Browsers trust certificates signed by recognized CAs. The CA ecosystem is hierarchical with root CAs and intermediate CAs.
ExampleDigiCert, Let's Encrypt, Comodo, GlobalSign
A top-level certificate authority whose certificates are pre-trusted by browsers and operating systems.
Root CA certificates are embedded in browsers, operating systems, and devices. They form the foundation of certificate trust. Root CAs sign intermediate certificates rather than end-entity certificates directly. Compromise of a root CA affects all certificates in its hierarchy.
ExampleDigiCert Global Root CA, ISRG Root X1 (Let's Encrypt)
A certificate signed by a root CA that signs end-entity (server) certificates.
Intermediate certificates create a chain between root CAs and server certificates. Servers must include intermediates in their certificate bundle. Missing intermediates cause "certificate not trusted" errors. Intermediates can be revoked without compromising the root.
ExampleDigiCert SHA2 Extended Validation Server CA
The date after which a certificate is no longer valid and must be renewed.
Certificates expire to limit damage from compromised keys and ensure regular security reviews. Let's Encrypt certificates expire after 90 days (encouraging automation). Paid certificates typically last 1 year. Expired certificates cause browser warnings and can break site access.
ExampleCertificate expires: 2025-06-15, Days remaining: 45
A combination of encryption, key exchange, and authentication algorithms used in TLS.
Cipher suites define how TLS connections are secured. They specify key exchange (RSA, ECDHE), encryption (AES-128-GCM, ChaCha20), and authentication (SHA256). Servers and clients negotiate a mutually supported suite. Modern configurations prioritize forward secrecy and AEAD ciphers.
ExampleTLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256
A property ensuring past sessions remain secure even if the server's private key is compromised.
Forward secrecy (or Perfect Forward Secrecy, PFS) uses ephemeral key exchange. Each session has unique keys that aren't derived from the server's long-term key. If the server key is later compromised, recorded past traffic can't be decrypted. ECDHE cipher suites provide forward secrecy.
ExampleECDHE key exchange provides forward secrecy
