1import{j as e}from"./index-0qbe4j-K.js";import{P as i}from"./prose-CP3GO64z.js";import{L as t}from"./react-vendor-CuqwDvgQ.js";function a(){return e.jsxs(i,{children:[e.jsx("p",{children:"A certificate is a signed statement binding a public key to a name. Everything people believe about it beyond that - that it vouches for the company, that it means the site is safe - is imported from somewhere else."}),e.jsx("h3",{children:"The fields worth reading"}),e.jsxs("ul",{children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Subject"})," - who the certificate is for. The CN is legacy; browsers read the SAN list."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Issuer"})," - who signed it. Equal to the subject means self-signed."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Validity"})," - not-before and not-after. Both matter; a clock skewed the wrong way rejects a perfectly good certificate."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"SANs"})," - the actual list of names it is valid for. A certificate with no SANs is not valid for any hostname in a modern browser, whatever the CN says."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Fingerprint"})," - a hash of the whole certificate, for comparing two copies."]})]}),e.jsxs("p",{children:["Read a real one with the ",e.jsx(t,{to:"/tools/cert-decoder",children:"Certificate Decoder"}),". Doing it once makes the rest of this concrete."]}),e.jsx("h3",{children:"Validation levels are mostly theatre"}),e.jsx("p",{children:"Domain Validated means someone proved control of the domain - usually by answering a challenge, in about ninety seconds, for free. Organisation and Extended Validation involve paperwork."}),e.jsxs("p",{children:["Browsers stopped showing EV differently years ago because it never changed user behaviour. So in practice a certificate proves control of a name, and nothing about the honesty of whoever controls it - which is the whole argument in"," ",e.jsx(t,{to:"/learn/what-the-padlock-does-not-tell-you",children:"what the padlock does not tell you"}),"."]}),e.jsx("h3",{children:"Self-signed is not the same as insecure"}),e.jsx("p",{children:"A self-signed certificate provides identical encryption. What it lacks is a third party attesting to the name, which is why browsers refuse it - they have no way to distinguish yours from an interceptor's."}),e.jsx("p",{children:"Inside infrastructure where you distribute the trust anchor yourself, self-signed or a private CA is perfectly reasonable. On something the public reaches, it trains users to click through warnings, which is a worse outcome than the certificate cost."}),e.jsx("h3",{children:"Expiry is the outage you schedule for yourself"}),e.jsx("p",{children:"Certificates are now issued for months rather than years, deliberately - short lifetimes limit the damage of a key compromise and force automation. The failure mode is the same every time: renewal was a calendar reminder, the person who owned it left, and the site goes down on a Sunday."}),e.jsx("p",{children:"Automate issuance and monitor expiry as a metric, not a reminder. And monitor the whole chain: an expired intermediate breaks everything under it while your own certificate looks fine."}),e.jsx("h3",{children:"The chain is the part that breaks"}),e.jsx("p",{children:'Clients verify a path from your certificate up to a root they already trust. Servers must send the intermediates - browsers often paper over a missing one by fetching it, and other clients do not. That is the classic "works in Chrome, fails in curl" report.'}),e.jsxs("p",{children:["Check what a host actually serves with the"," ",e.jsx(t,{to:"/tools/security-headers",children:"Security Headers Grader"})," alongside the decoder, and remember that transport security is only one of several headers doing work."]})]})}export{a as default};
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.