SSL Certificate

What is an SSL Certificate?

An SSL Certificate (Secure Sockets Layer Certificate) is a digital certificate that authenticates the identity of a website and enables an encrypted connection between a web server and a client’s browser. SSL certificates are issued by Certificate Authorities (CAs) and contain the website’s public key and identity information.

SSL Certificate Components

Public Key

Used by clients to encrypt data sent to the server

Private Key

Kept secret by the server, used to decrypt incoming data

Certificate Information

• Domain name(s)
• Organization details
• Certificate Authority
• Issue and expiration dates
• Certificate signature

Types of SSL Certificates

Domain Validation (DV)

# Free from Let's Encrypt
certbot certonly --standalone -d example.com

Validates domain ownership only, issued quickly.

Organization Validation (OV)

Validates organization identity, shows company name in certificate.

Extended Validation (EV)

Highest validation level, displays company name in browser address bar (some browsers).

Wildcard Certificates

*.example.com
# Covers:
# - www.example.com
# - api.example.com
# - blog.example.com

Multi-Domain (SAN)

example.com
www.example.com
api.example.com
example.org

SSL/TLS Handshake

Client → Server: ClientHello
Server → Client: ServerHello + Certificate
Client: Verifies certificate
Client → Server: Encrypted session key
Server ← → Client: Encrypted communication begins

Obtaining SSL Certificates

Let’s Encrypt (Free)

# Install Certbot
sudo apt install certbot

# Obtain certificate
sudo certbot certonly --standalone -d example.com -d www.example.com

# Auto-renewal
sudo certbot renew --dry-run

Commercial CAs

• DigiCert
• GlobalSign
• Sectigo
• GoDaddy

SSL in Web Development

// Check SSL certificate validity
const checkSSL = async (domain: string) => {
  const response = await fetch(\`https://\${domain}\`);
  
  // Certificate info available in some environments
  console.log('Protocol:', response.url.startsWith('https://'));
  console.log('Status:', response.status);
};

// Force HTTPS
if (location.protocol !== 'https:') {
  location.replace(\`https:\${location.href.substring(location.protocol.length)}\`);
}

Certificate Pinning

// Mobile app example
const expectedFingerprint = 'AA:BB:CC:DD...';

// Verify certificate matches expected fingerprint
if (cert.fingerprint !== expectedFingerprint) {
  throw new Error('Certificate mismatch - possible MITM attack');
}

SSL Certificate Errors

Common Issues

1. Expired Certificate

   • Certificate past expiration date
   • Solution: Renew certificate

2. Self-Signed Certificate

   • Not signed by trusted CA
   • Solution: Use CA-signed certificate

3. Domain Mismatch

   • Certificate doesn’t match domain
   • Solution: Obtain certificate for correct domain

4. Incomplete Certificate Chain

   • Missing intermediate certificates
   • Solution: Install full certificate chain

CorsProxy and SSL

// CorsProxy handles SSL/TLS automatically
const data = await fetch(
  'https://corsproxy.io/?url=https://secure-api.com',
  {
    headers: {
      'x-cors-api-key': process.env.CORS_API_KEY
    }
  }
);

// Certificate validation happens at proxy level
// Your app → CorsProxy: TLS with CorsProxy cert
// CorsProxy → Destination: TLS with destination cert

Learn More

• SSL protocol details
• TLS encryption
• HTTPS implementation
• Encryption fundamentals