What is an SSL/TLS certificate?

Short answer

An SSL/TLS certificate is an X.509 document that proves the identity of a server: it carries the server's public key, the domains it is valid for, its validity period and the information of the CA that signed it. In the TLS handshake, the client receives the certificate, verifies its signature up to the CAs it trusts and checks that the domain it connected to is present in the certificate. In TR7, certificates are kept on the SSL/TLS Certificates screen; each record carries the certificate, the private key and the certificate chain together, and is selected in the Certificate field of the HTTP or L7 TCP vService.

Where It Is Used in TR7

Where	Field / label	What for
Certificates & PKI → SSL/TLS Certificates → Add	Type: ACME.SH, Manual, PFX, Internal CA	Obtaining the certificate with ACME, uploading it as PEM or PFX, or generating it with an internal CA
SSL/TLS Certificates → CSR (External CA) tab	CSR record	Generating the key on TR7 and having the certificate signed by an external CA
SSL/TLS Certificates → preview → Details	CN, DNS, Cert. Validity, Cert. Algorithm, Key Length	Viewing the content of the certificate
SSL/TLS Certificates list → Filter	Expiry Health: Expired, Expiring Soon, Valid, No Certificate	Separating out the certificates that have expired or are about to expire
HTTP vService and L7 TCP vService	Certificate	The certificates to be presented on the frontends where TLS is terminated on TR7; the field appears when an encrypted option is selected in the frontend Protocol field

How Does It Work?

1. The certificate combines its owner's public key with identity information (subject, SAN list) and is signed by a CA (RFC 5280).
2. In the handshake, the server sends its certificate and the intermediate certificates.
3. The client verifies the signatures up to a root CA in its trust store, and examines the validity period and the domain match.
4. Within the handshake, the server proves that it has the private key corresponding to the public key in the certificate; then the encrypted session is established.

Common Misconceptions

• "The certificate encrypts the traffic." The data is encrypted with the session keys generated in the handshake; the certificate carries the server's identity and public key.
• "The browser looks only at the validity period of the certificate." The domain match and the certificate chain reaching a trusted root CA are also required (What is a certificate chain?).
• "The certificate is bound to the frontend row of the vService." The Certificate field is at the vService level; the selected certificates are presented on all the encrypted frontends of the vService.

How it is done in the documentation

• SSL/TLS Certificates · What Is an SSL/TLS Certificate?
• SSL/TLS Certificates · Certificate Types
• HTTP (L7) vService · Certificate

Related questions

• How do I upload my certificate to TR7; which formats are supported?
• The browser says "certificate not trusted"; what are the possible causes?
• How do I filter certificates that have expired or are about to expire (Expiry Health)?
• What is a Private Key?