Ever wonder why you see a little padlock icon next to a website’s address and what it really means for your data? This article explains how HTTPS certificates protect online connections, how they are created, and what you can do to stay safe when browsing or running online services.
What an HTTPS certificate is and how it works
HTTPS stands for Hypertext Transfer Protocol Secure. It is the protocol that encrypts data exchanged between your browser (or any client) and a web server. The encryption is made possible by a digital certificate, also called an SSL/TLS certificate.
A digital certificate is a small data file that binds a public cryptographic key to a domain name (for example, example.com). The certificate is issued by a trusted third party known as a Certificate Authority (CA). The CA verifies that the applicant controls the domain and then signs the certificate with its own private key. This signature tells browsers, “The CA vouches for this key‑domain pairing.”
When you visit a site, the server presents its certificate. Your browser checks two things:
- Is the certificate signed by a CA that the browser trusts?
- Does the certificate’s domain match the address you typed?
If both checks pass, the browser uses the public key from the certificate to establish a secure session key. This session key encrypts all traffic, preventing eavesdroppers from reading or altering the data.
Key terms:
- Public key – a cryptographic key that anyone can see; used to encrypt data or verify signatures.
- Private key – a secret counterpart to the public key; used to decrypt data or create signatures.
- Certificate Authority (CA) – an organization that issues and signs certificates.
- Intermediate certificate – a certificate issued by a CA that signs end‑entity (website) certificates; it creates a chain of trust back to the root CA.
- Certificate Transparency (CT) – a public log that records every certificate issued, helping detect fraudulent certificates.
Real‑world example: the eMudhra intermediate certificate flaw
In October 2026, a flaw was discovered in the way eight intermediate certificates issued by the Indian CA eMudhra Limited were generated. The private keys used to sign those certificates were created with insufficient randomness, making them easy to guess. As a result, anyone could forge certificates that appeared to be signed by eMudhra and impersonate any website.
Major browser makers and cloud providers responded quickly. Mozilla blocked the affected certificates in its OneCRL list on the same day it learned of the issue. Chrome, Safari, and Edge added the blocks within a few days, and Cloudflare updated its services to reject the compromised certificates. The incident reminded the industry of the 2011 DigiNotar breach, where a compromised CA issued thousands of fraudulent certificates.
What this means for you
If you are a casual web user, the immediate risk is low as most modern browsers automatically receive updates that block known bad certificates. However, not every application uses a browser’s built‑in trust store. Custom software, older operating systems, or embedded devices may still accept a forged certificate, exposing you to man‑in‑the‑middle attacks where an attacker can read or modify your traffic.
If you run a website, especially one that handles personal data or financial transactions, a compromised intermediate certificate could allow attackers to create a fake version of your site that looks perfectly legitimate. This could lead to credential theft, phishing, or financial loss for your users.
How to check and protect yourself
- Keep software up to date. Browser updates, operating system patches, and firmware upgrades often include the latest list of trusted and revoked certificates.
- Use browsers that enforce Certificate Transparency. CT logs make it easier to spot unexpected certificates for your domain.
- Monitor your domain’s certificates. Services like crt.sh let you view all certificates issued for a domain. If you see an unknown certificate, investigate immediately.
- Prefer CAs with strong key‑generation practices. Reputable CAs follow industry standards for randomness and key length, reducing the chance of a similar flaw.
- Configure your servers to reject weak ciphers and old TLS versions. This limits the attack surface even if a certificate were somehow forged.
FAQ
What is the difference between a root certificate and an intermediate certificate?
A root certificate is the top‑level certificate stored in a browser’s trust store; it is self‑signed by the CA. An intermediate certificate is signed by the root and is used to sign end‑entity (website) certificates, creating a chain of trust that can be revoked without affecting the root.
Can I still be vulnerable if I use a modern browser?
Modern browsers automatically receive revocation lists and CT updates, so they will block known bad certificates. Vulnerability remains for non‑browser applications that rely on outdated trust stores or do not check CT logs.
How can I tell if a website’s certificate is legitimate?
Click the padlock icon in the address bar. The browser will show details such as the issuing CA, the validity period, and whether the certificate is trusted. You can also view the certificate’s fingerprint and compare it to a known good value if you have one.
What should I do if I suspect a certificate has been compromised?
Stop using the site immediately, especially for sensitive transactions. Report the issue to the website owner and to the CA that issued the certificate. Use a tool like crt.sh to check for unexpected certificates and consider changing passwords on affected services.
This article references reporting from cointelegraph.com.
