Effortless digital trust for enterprise security

An SSL (Secure Sockets Layer) certificate is a digital credential that authenticates the identity of a website and encrypts information sent to and from the server, ensuring sensitive data remains private and secure between a user's browser and the web server.

SSL certificates establish a secure, encrypted connection by leveraging public-key cryptography. When a user accesses a secure website, the server presents its SSL certificate. The browser verifies this certificate, and upon successful validation, a secure session is established, encrypting all subsequent data exchange.  

A Public CA (Certificate Authority) issues widely trusted SSL certificates recognised by all major web browsers and operating systems, typically used for public-facing websites and services. In contrast, a Private CA issues certificates within a closed, internal network or organisation, providing robust security for internal applications, intranets, and secure communications in controlled environments.

A SAN (Subject Alternative Name) certificate secures multiple distinct domain names and subdomains, which must be explicitly listed within the certificate. A Wildcard certificate, on the other hand, secures a single primary domain and all its first-level subdomains (e.g., *.example.com), offering flexible coverage for dynamic or expanding subdomain structures under one umbrella.

Upon expiration, an SSL certificate's validity ceases, leading to broken encrypted connections. Browsers will display prominent security warnings to visitors, indicating that the site is no longer trusted or secure. This can severely erode user trust, disrupt website functionality, and negatively impact your brand's reputation.

A CSR is a uniquely generated, encoded text file created on a server to initiate the process of applying for an SSL certificate. It contains vital information about your organisation (e.g., domain name, company name, location) and, critically, includes the server's public key. This CSR is then submitted to the Certificate Authority (CA) to generate your specific SSL certificate.

A private key is a highly confidential cryptographic key generated on the server concurrently with the CSR. It forms a crucial pair with the public key (contained in the CSR) and is essential for decrypting data and establishing secure SSL connections. The private key shall be encrypted using a Key Encryption Key (KEK) generated from your vault and stored securely based on the desired use cases & regulations. Maintaining its confidentiality is critical, as any compromise would invalidate the associated SSL certificate and expose secure connections to risk.

The CSR contains the public key, which is mathematically linked to the private key. Together, they form a unique cryptographic key pair. While the public key in the CSR is sent to the CA to sign and create the SSL certificate, it is the private key that works in conjunction with the issued certificate to establish secure, authenticated SSL sessions with client browsers.

A: Losing the private key renders your associated SSL certificate unusable, as it's the fundamental component required to establish secure connections. In such a critical scenario, you must immediately generate a new CSR and private key, then reapply for a replacement certificate from your CA, and finally reinstall this new certificate on your server.