Public Key Infrastructure (PKI) and Transport Layer Security (TLS/SSL) form the foundation of secure digital communications, enabling encrypted connections and identity verification across the internet. PKI provides the organizational framework for managing digital certificates and cryptographic keys, while TLS/SSL protocols use these certificates to establish secure, authenticated channels between clients and servers. Understanding certificate types, validation mechanisms, and the TLS handshake process is essential for implementing robust security architectures, from basic HTTPS websites to complex zero-trust environments requiring mutual authentication.
What This Cheat Sheet Covers
This topic spans 20 focused tables and 174 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
Table 1: Certificate Types and Validation Levels
Not all certificates are created equal — they differ both in how much the issuer verifies about you and in how many names a single certificate covers. The first three rows trade speed for assurance (a free DV cert issued in minutes versus an EV cert that demands legal and physical checks), while the rest are about coverage: when you reach for a wildcard, a multi-domain SAN cert, or a plain single-domain certificate depends entirely on how your hostnames are laid out.
| Type | Example | Description |
|---|---|---|
Let's Encrypt free certificate | • Validates only domain ownership via automated challenge • no organization identity verification • issued in minutes • suitable for blogs and basic HTTPS | |
Certificate showing company name | • Validates domain ownership and organization legal identity • CA verifies business registration • requires 1-3 days • shows organization name in certificate details | |
Certificate showing green address bar (legacy) | • Highest validation level with rigorous identity verification • requires legal, physical, and operational checks • historically displayed green bar in browsers (deprecated in modern browsers) • now shows organization name in certificate viewer | |
*.example.com covers api.example.com, shop.example.com | • Single certificate covering all subdomains at one level • uses asterisk notation • does not cover base domain unless listed separately • simplifies multi-subdomain deployments |