TLS certificates — Cyberstack

A certificate is not a padlock icon. It is a signed statement that this public key belongs to this name, from a CA the client already trusts.

First principles

TLS protects data in transit. The certificate is how the client decides it is talking to the name it asked for. Three parts: a public key, a name (the DNS name on the certificate), and a signature from a certificate authority. The client already has a list of CAs it trusts — shipped with the OS or the browser.

On connect, the site presents the certificate. The browser checks the signature against a trusted CA, checks that the name matches the host you typed, and checks the dates. Fail any of those and you get a warning. The padlock is that check passing, not a separate product.

Not an SSH key

SSH keys and TLS certificates both use public-key maths. They are not interchangeable. SSH trust is usually TOFU plus authorized_keys — you pin a key to a host or an account. TLS trust is a public CA ecosystem. A Let's Encrypt certificate will not sit in authorized_keys. An SSH host key will not satisfy a browser. Different files, different trust, different failure modes.

Let's Encrypt, at a high level

Let's Encrypt is a CA. You prove you control a DNS name (typically by answering an HTTP or DNS challenge). They sign a short-lived certificate for that name. You install it on the listener. You renew before it expires. That is the whole loop. Automation is the control; a human calendar is how certificates silently expire.

The certificate is public. The private key that matches it is not. Same house rule as SSH: the private key stays on the machine that terminates TLS. Copying that key into git or chat burns it. Issue a new certificate and discard the old key if it leaked.

What an admin actually does

Terminate TLS on the edge you control. Do not ship the private key to every container 'just in case'.
Monitor expiry. Ninety days is a Let's Encrypt default, not a suggestion to ignore.
Name the names. A certificate for the apex is not a certificate for the www host unless you asked for both.
Redirect HTTP to HTTPS after the certificate works. Doing it first just breaks the issuance challenge.