Inspect and validate X.509 security certificates and expiry details.
An X.509 Certificate is essentially a digital passport. It cryptographically binds a Public Key to an identity (like a domain name, email, or organization).
When you visit a website (e.g., google.com), the server sends your browser its certificate. This allows your browser to encrypt the initial TLS handshake using the public key, ensuring only Google's server (which holds the private key) can decrypt it.
How does your browser know the certificate isn't fake? It looks at the Issuer and the Digital Signature.
The certificate is cryptographically signed by a Certificate Authority (CA) like Let's Encrypt. Your browser then looks at the CA's certificate, which is signed by a higher CA, forming a Chain of Trust.
This chain eventually ends at a "Root CA". Your operating system (Windows, macOS) or browser (Firefox) comes pre-installed with a list of trusted Root CAs. If the chain links back to a trusted root, you get the padlock icon. If not, you get a giant red warning screen.
If a private key is hacked or stolen, the certificate must be invalidated before its expiration date. This is called Revocation.
Certificates include extensions pointing to the CA's CRL (Certificate Revocation List) or OCSP (Online Certificate Status Protocol) endpoints. Browsers query these endpoints in real-time to ask "Is this certificate still valid today?"
How does a browser decide if it should trust a website's TLS certificate?
