It sounds like this“A certificate is just a file the site makes about itself, so it can't prove who the site is.”
Thinking a certificate proves nothing because anyone can make one
Why it feels right
Anyone can type up a document that says 'this is the real website', so a certificate that comes from the site itself sounds worthless. If the site says who it is, a fake site would say the same, so the whole system looks like people vouching for themselves.
Why it’s wrong
A certificate is signed by a certificate authority, which your browser already trusts. The authority checks that the applicant controls the domain before it signs. A site can't forge that signature, and your browser checks it every time.
A worked example
A certificate does come from the site, but it is signed by someone else. Your browser or device carries a list of about a hundred and fifty certificate authorities, companies such as Let's Encrypt, DigiCert and Sectigo that it trusts. A site asks one of them for a certificate, and the authority checks that the applicant really controls the domain, for instance by asking them to place a file at that address. If it is satisfied, it signs the certificate with its private key.
When you connect, the site sends its certificate. Your browser checks the signature against the authority's public key, which it already holds, and checks that the name matches the one you asked for and that it hasn't expired. A fake certificate you made yourself fails the check, because you can't produce the authority's signature.
There are often two steps: the authority signs an intermediate, which signs the site. This chain of signatures leads back to a name on your browser's list. The weak point isn't forgery but trust: if an authority signs carelessly, the system fails, which is why browsers can and do remove authorities that have been caught.
How to catch yourself
- You say a certificate is only the site's own claim.
- You think you could fool a browser with a certificate you wrote yourself.
- You don't know why a browser carries a list of trusted companies.
What to hold instead
A certificate is signed by an authority that the browser already trusts, after checking the applicant controls the domain. The browser checks that signature, the name and the date, so a certificate a site makes for itself fails.
Where you’ll meet it
- Seeing a browser warning about an untrusted certificate.
- Setting up a free certificate for a small website.
- Wondering why a certificate has an expiry date.
Questions people ask
- What is an HTTPS certificate?
- A file that ties a website's name to its public key, signed by a certificate authority the browser trusts. It lets the browser check that it is talking to the holder of that domain, not to someone in the middle.
- What does the browser warning 'your connection is not private' mean?
- That the certificate failed a check: it may be expired, issued for a different name, or not signed by an authority the browser trusts. The connection might be encrypted, but the browser can't tell who is on the other end.