MENU


What Certificates Prove

What a Certificate Actually Proves

A certificate binds a public key to names, signed by a CA. A domain-validated (DV) certificate, the only kind Let's Encrypt 1,144 issues, proves that whoever asked controlled those names at issuance, and nothing about who runs the site or whether it is honest. OV and EV certificates add checked company details that browsers no longer display differently. Front-End Web Development of this series covers chain validation.

What the test certificate from Section 1.15.3 containsShell
sudo openssl x509 -in /etc/letsencrypt/live/example.com/cert.pem -noout \
  -issuer -dates -ext subjectAltName
Output
issuer=CN=Pebble Intermediate CA 100255
notBefore=Sep 23 06:53:43 2026 GMT
notAfter=Dec 22 06:53:42 2026 GMT
X509v3 Subject Alternative Name: critical
    DNS:example.com, DNS:www.example.com

Browsers match names only against the Subject Alternative Name list. A real certificate names a Let's Encrypt intermediate and chains to the ISRG roots; Pebble 789 makes a new intermediate on every start.