🏛️

TLS Certificate Chains

Complex

Free preview · 2 of 7 steps

The trust problem: who vouches for the server?

When you connect to bank.example.com, how does your browser know it's really the bank and not an impersonator?

The server sends a TLS certificate — a digital ID card. But anyone can create a certificate claiming to be any domain.

Solution: Certificate Authorities (CAs) — trusted third parties that verify domain ownership before signing certificates. Your browser comes pre-loaded with ~150 trusted Root CA certificates.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step