a digital certificate

A public key is just a number, and anyone can generate one and claim it belongs to your bank. So how do you trust that a public key really belongs to who it says? Think of a passport: it binds your photo and name together, and you trust it because a government you respect issued and stamped it. A digital certificate is the passport for a public key — a document that binds a public key to an identity (like a domain name), vouched for by the signature of a trusted third party.

Concretely, a certificate is a small data file containing a subject (e.g. the domain example.com), that subject's public key, a validity period, the issuer's name, and — crucially — a digital signature from a certificate authority (CA) over all of it. When your browser connects to a site over HTTPS, the server sends its certificate. Your browser checks the CA's signature using the CA's public key (which it already trusts, because it ships with a built-in list of trusted CAs), confirms the certificate hasn't expired or been revoked, and checks that the domain in the certificate matches the site you asked for. If all pass, the browser trusts that the public key in the certificate really belongs to that domain.

Why it matters: the certificate is what defeats a man-in-the-middle. Without it, an attacker could hand you their own public key while claiming to be your bank, and you'd happily encrypt your secrets straight to the attacker. The certificate cryptographically ties the key to the name. The crucial honest limit: a valid certificate proves only that you're talking to whoever controls that domain name — it says nothing about whether they're honest or their content is safe. A phishing site can get a perfectly valid certificate for its own lookalike domain. The lock icon means 'encrypted to this named server,' not 'this site is trustworthy.'