A public certificate authority (CA) issues a TLS certificate after verifying that the requester is authorized for the domain names it contains. The CA signs the certificate, which binds those names to a public key; a browser or other client then checks the certificate chain against its own trust rules. If a certificate must be invalidated before it expires, the CA can revoke it and publish status information—but revocation does not instantly update or block every client.
What a TLS certificate does
A TLS server certificate is a signed statement that associates a public key with one or more names, such as a website’s domain. It also carries information such as the issuer, a serial number, a validity interval, and required extensions. Publicly trusted TLS certificates use the X.509 profile, with additional requirements set by the CA/Browser Forum. RFC 5280 describes the X.509 certificate and path-validation framework; the CA/Browser Forum Baseline Requirements set requirements for public TLS certificates.
As an Amazon Associate I earn from qualifying purchases.
A certificate is not the private key, and it does not itself encrypt website traffic. During a TLS connection, the server proves possession of the corresponding private key as part of the protocol. The key should remain under the subscriber’s control; the CA needs the public key, not the private key.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →How a public CA issues a certificate
1. The subscriber creates a key pair and request
In a conventional enrollment, the subscriber creates a public/private key pair and sends the CA a PKCS #10 certificate signing request (CSR). The CSR includes the public key and requested names. The private key stays with the subscriber.
#1 Best Overall
2. The CA validates the requested domain names
For a domain-validated (DV) certificate, the CA must establish effective control of each requested domain. That is different from merely checking that a website already uses HTTPS: the applicant must satisfy an accepted validation method. DV does not, by itself, verify the applicant’s real-world identity.
Organization-validated (OV) and extended-validation (EV) processes include additional checks of real-world identity information. Those checks do not automatically make the TLS connection cryptographically stronger; the certificate’s key binding and the server’s configuration still matter. The distinctions and automated validation workflow are described in RFC 8555, while public-certificate validation requirements are set by the CA/Browser Forum.
3. The CA checks and signs the certificate
If the request and required validations pass, the CA issues an X.509 certificate containing the approved names and public key. The CA signs it with its own signing key. The certificate’s issuer, serial number, validity dates, and extensions help clients interpret and validate it.
4. The subscriber installs the certificate and chain
The server is normally configured to send its leaf certificate and the intermediate certificates needed to connect it to a trusted root. The client builds and validates a certification path to a trust anchor in its own trust store. Exactly how a client builds that path can vary; there is no single universal certificate-fetching behavior. RFC 5280 specifies path validation, not one required fetching strategy.
5. The subscriber renews and deploys replacements
A certificate’s validity period ends at its expiration date unless it is revoked earlier. Subscribers should track expiry and renew in time to install the replacement, reload or restart services where necessary, and verify that the live endpoint serves the new certificate. A certificate can be valid on paper while a site still fails TLS checks because of a missing intermediate, a name mismatch, mishandled keys, or server configuration problems.
How ACME automates issuance
ACME is a protocol for automating interactions between a client and a CA; it is not itself a CA or a certificate. An ACME client can request authorization for domain names, respond to challenges that demonstrate control, create and finalize an order, and retrieve the resulting certificate. Each CA decides whether and how it offers ACME. The protocol is specified in RFC 8555.
Rank #3
Automation reduces repetitive enrollment work, but does not remove the subscriber’s operational responsibilities. The system still needs to protect the private key, complete domain challenges, deploy the certificate and chain correctly, and confirm that renewal succeeded. For deployments with many certificates, renewal, distribution, service reloads, and monitoring all need to work reliably.
How long public TLS certificates can be valid
For publicly trusted TLS subscriber certificates issued from 15 March 2026 through 14 March 2027, the CA/Browser Forum maximum validity period is 200 days. This is a cap, not a target or a promise that every certificate will last that long. The schedule also reduces permitted validity and validation-data reuse in later periods; consult the effective requirements for the applicable issuance date. See the CA/Browser Forum requirements redline and the SC081v3 schedule.
The cap applies to public TLS subscriber certificates, not every kind of certificate or private enterprise PKI. Shorter permitted lifetimes make dependable renewal and deployment more important: an automation failure can leave a service with an expired certificate sooner than under older, longer-lived certificates.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why and how a CA revokes a certificate
Revocation marks a certificate invalid before its stated expiration. Reasons can include a compromised or suspected-compromised private key, incorrect issuance, a domain or identity change, or a changed relationship between the subject and CA. RFC 5280 describes early invalidity circumstances and the CA’s role in revocation.
Revocation requests
ACME defines a revocation operation. A request can be authorized by an account key or, under the protocol’s conditions, by the certificate’s private key; the server must check that the signer is authorized before revoking. A subscriber using an ACME-enabled CA can follow that CA’s revocation process. See RFC 8555.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →As one CA-specific example, ISRG’s Let’s Encrypt CP/CPS says anyone can request revocation through its ACME revocation interface and that, depending on circumstances, its revocation timelines can be as short as 24 hours or less. That is Let’s Encrypt’s stated policy, not a universal deadline for every CA. Let’s Encrypt CP/CPS.
How status information is published
One mechanism is a certificate revocation list (CRL), a CA-signed, time-stamped list identifying revoked certificates. Online Certificate Status Protocol (OCSP) is another status mechanism. Publication and checking depend on the CA and the relying-party implementation; status information may also be cached.
What revocation means for browsers and other clients
Revocation is not a magic switch that instantly reaches every browser. Whether and when a client observes a revocation depends on its implementation and policy, cached status, network availability, and the CA’s publication behavior. It is inaccurate to assume that every browser always makes a live OCSP request or that revocation universally causes an immediate block.
RFC 9608 defines a special profile for certificates that have no revocation information available. That is a deliberate special case, not a general rule that ordinary public certificates have no revocation status. RFC 9608.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choosing an issuance and lifecycle approach
The right approach depends on the certificate’s validation needs and on whether the deployment can operate the full lifecycle, not simply on which CA issues it.
- Validation scope: Use DV when domain control is the relevant validation; consider OV or EV when the workflow requires additional organizational identity checks.
- Enrollment: Manual enrollment may suit a small or infrequently changed environment. ACME can automate authorization and issuance when the CA supports it and the environment can complete challenges.
- Renewal and deployment: Confirm that the system can renew, distribute the new certificate and chain, reload services, and alert on failures.
- Revocation readiness: Consider how the organization will respond to key compromise or incorrect issuance, and whether its services can tolerate the CA’s applicable revocation process.
These are lifecycle trade-offs rather than a ranking of providers; no single CA is best for every deployment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
