An SSL/TLS certificate is a digital credential that helps a website prove its identity and establish an encrypted connection with a browser or app. In practice, it contains the site’s public key and information that a certificate authority has signed, allowing clients to trust that they are connecting to the expected domain rather than an impostor. Modern sites use TLS, even when people still say “SSL.”
In cyber security, certificates matter because they protect login pages, payment forms, admin portals, and APIs from interception and tampering. They are a basic defense against man-in-the-middle attacks on untrusted networks. At the same time, a valid certificate does not guarantee that a site is legitimate: phishing sites can also obtain certificates for lookalike domains. Defenders therefore monitor certificate issuance, expiration, domain matching, and renewal to avoid outages and reduce abuse.