Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is a TLS Certificate?

Definition

A TLS certificate is a digital credential that proves a website or mail server really belongs to its domain and lets browsers set up an encrypted connection to it. It is what puts "https" and the padlock in the address bar. A certificate authority issues it after checking that the requester controls the domain.

How It Works

When a browser connects to a site, the server presents its certificate. The browser checks three things: that the certificate covers the exact domain name, that it was signed by a certificate authority the browser trusts, and that it has not expired. If any check fails, the visitor sees a full-page warning. If they pass, TLS encrypts everything between the browser and the server, including logins, forms, and card details.

Certificates expire on purpose, so stolen or mistaken certificates do not stay valid for long. That window is shrinking. In April 2025, the CA/Browser Forum, the body of certificate authorities and browser makers, passed Ballot SC-081v3, which reduces the maximum validity of public TLS certificates from 398 days to 47 days in stages "starting in March 2026 and concluding in March 2029." Let's Encrypt, which already issues 90-day certificates, announced it will move to 45 days by 2028.

The practical result is that manual renewal no longer works. Certificates need automatic renewal (usually through the ACME protocol) and monitoring that alerts before anything expires. Certificates are also used inside networks, on firewalls, VPNs, mail servers, and security tools, where expirations are easier to miss.

Real-World Example

GAO's 2018 report on the Equifax breach said that Equifax had installed a device to inspect network traffic for malicious activity, but "a misconfiguration allowed encrypted traffic to pass through the network without being inspected." As reported by SecurityWeek, GAO traced that misconfiguration to a digital certificate that had expired 10 months before the breach, which let attackers run commands and move data out over encrypted connections undetected. A network administrator doing routine checks eventually found the problem. The breach exposed personal information of at least 145.5 million people.

Why It Matters for a Small Business

An expired certificate on a website produces a browser warning that stops customers cold, breaks online payments, and hurts search visibility. An expired certificate on a firewall, mail server, or backup tool can quietly switch off a security control, as Equifax learned. With validity periods falling toward 47 days, any certificate still renewed by hand is a scheduled outage waiting to happen on a busy day. Automating renewal once removes a recurring chore, prevents embarrassing outages, and keeps security tools that rely on certificates working.

How to Spot It / How DTS Handles It

Warning signs: browser certificate warnings, renewals tracked in someone's calendar, certificates bought for one or two years and installed by hand, mail clients complaining about certificates, and internal devices with self-signed or expired certificates.

DTS can help with listing the certificates on websites and devices, moving them to automatic renewal, and setting up expiry alerts. See our WordPress maintenance service for websites, or our managed IT service for internal systems.

Related Terms

  • HSTS: forces browsers to use HTTPS.
  • Mixed content: insecure pieces on an HTTPS page.
  • DNS hijacking: how attackers obtain valid certificates for your domain.
  • MTA-STS: certificate-checked encryption for email.
  • Security logging: the monitoring an expired certificate can silently break.
  • Asset inventory: knowing where every certificate lives.

Sources

  • CA/Browser Forum, Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods (April 11, 2025): https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/
  • Let's Encrypt, Decreasing Certificate Lifetimes to 45 Days (December 2, 2025): https://letsencrypt.org/2025/12/02/from-90-to-45/
  • GAO, Data Protection: Actions Taken by Equifax and Federal Agencies in Response to the 2017 Breach, GAO-18-559 (August 2018): https://www.gao.gov/products/gao-18-559
  • SecurityWeek, Attackers Made 9,000 Unauthorized Database Queries in Equifax Hack: Report (September 10, 2018; reporting GAO-18-559): https://www.securityweek.com/attackers-made-9000-unauthorized-database-queries-equifax-hack-report/

Last updated October 14, 2026.