What an SSL certificate actually contains

SSL certificates come up constantly in server work — getting them, renewing them, fixing errors caused by them. Most people treat them as a black box. Here's what's actually inside one.

The basic contents

An SSL certificate is a document that contains several pieces of information:

The domain name it's issued for
The public key of the server
The identity of the Certificate Authority that issued it
The issue and expiry dates
A digital signature from the CA

When your browser connects to an HTTPS site, the server sends this certificate. Your browser checks the CA signature against its built-in list of trusted CAs, checks the domain matches, checks it hasn't expired — if all that passes, the padlock appears.

The files you actually deal with

When Certbot issues a certificate it creates several files in /etc/letsencrypt/live/yourdomain/:

fullchain.pem — your certificate plus the CA chain. This is what nginx uses for ssl_certificate
privkey.pem — your private key. This is what nginx uses for ssl_certificate_key. Never share this
cert.pem — just your certificate, without the chain
chain.pem — just the CA chain

The private key is the thing that needs protecting. The certificate is public — it gets sent to every browser that connects. The private key never leaves the server. If it's compromised, the certificate needs to be revoked and reissued.

Wildcard certificates

A standard certificate covers one specific domain. A wildcard certificate covers all subdomains of a domain — *.myserverhost.example.com covers panel.myserverhost.example.com, api.myserverhost.example.com, any subdomain. Certbot can issue wildcards via DNS validation. Useful when you have a lot of subdomains.

Certificate expiry

Let's Encrypt certificates expire after 90 days. Certbot sets up a systemd timer or cron job to automatically renew them before they expire. Check it's working with certbot renew --dry-run. An expired certificate produces browser warnings that will send users away immediately — worth making sure auto-renewal is actually running.

Inspecting a certificate

openssl x509 -in /etc/letsencrypt/live/yourdomain/cert.pem -text -noout

This prints everything in the certificate in human-readable form — useful for debugging cert issues or just satisfying curiosity about what's actually in there.