Glossary of common terms

Automatic Certificate Management Environment (ACME) is a protocol for automatic management of SSL/TLS certificates between the server and the CA without administrator intervention. This automation is handled by so-called ACME clients – tools (e.g. Certbot or acme.sh) that run directly on the server. Thanks to automation, it eliminates the risk of expired certificates and saves time and money. Read more about ACME and its use on web servers here.

Certificate Authority (CA) is an entity that issues digital certificates (electronically signed public key). The Authority confirms the authenticity of the data entered in the certificate prior to release. We offer a range of certificates from DigiCert, Thawte, GeoTrust and RapidSSL. These CAs are fully trusted, so their certificates do not pose any security warnings on your browser as self-signed certificates do.

If you do not know, which certificate authority to choose, use our TLS certificate Selection Guide.

Certification Authority Authorization (CAA) is a DNS record specifying which CAs are allowed to issue certificates for a given domain. It serves as protection against unauthorized certificate issuance by third parties. Since September 2017, all public CAs are required to check CAA records before issuing a certificate.

The Common Name in the TLS certificate indicates the domain for which the certificate is issued. A Common name such as www.domain.com. In Code Signing certificate for signing applications in the field of Common name given authenticated name of the organization for which the certificate.

Certificate Revocation List (CRL) is a list of certificates that have been revoked during the validity and are no longer credible. The reason for early termination is usually a compromised private key. Each Certificate authority publishes this list on its website and CRL is used to verify the validity of the certificate.

DigiCert KeyLocker is a cloud solution for managing private keys of Code Signing certificates. It is part of the DigiCert ONE platform and provides a FIPS 140-2 Level 3 certified key store as an alternative to physical tokens or in-house HSM devices. It enables secure remote code signing.

DigiCert Trust Lifecycle Manager (TLM) is a DigiCert platform for centralized management of the digital certificate and PKI lifecycle. It enables issuance, renewal, and revocation of certificates from a single place. It ensures process automation and pre-expiration notifications. It supports various types of certificates (public and private) and integration with existing systems. TLM can be deployed in the cloud, on-premise, or hybrid.

A safer and more modern successor to the SCEP communication protocol, which allows IoT devices to automatically obtain and renew digital certificates over a secure HTTPS connection.

An Intermediate certificate is a certificate authority, which is necessary for full trust of your TLS certificate in browser. If the intermediate is not installed on a server, the browser will display a warning about the unknown issuer and security risks. Intermediate certificates are always sent with the client certificate. You do not have to look for it.

The TLS certificate is not bound to the IP address and the IP can be changed anytime. It's just a matter of DNS. Thanks to the SNI you do not need a separate IP adress for every single domain on your server.

If you need to secure multiple domains, we recommend SAN certificates, which allows you to secure up to 250 domains on one IP adress.

A security mechanism based on the TLS protocol in which mutual identity verification takes place – the server proves itself to the client with its certificate, and the client simultaneously proves itself with its own client certificate. It is used mainly to secure APIs, microservices, and internal systems.

To order an X9 PKI certificate and for more information click here.

A protocol for online verification of whether a certificate has been revoked (i.e., whether it is still valid), an alternative to the traditional CRL.

The issued certificate can only be used with the correct private key. The private key is created on the server during the development of the request for a certificate (CSR, public key). This is the most important file that must not at any price leave the server to be compromised. With the private key, anyone can use your TLS certificate, so you may obtain the aim of attackers and hackers.

If you delete the private key or it is compromised, do not hesitate to contact customer support a free certificate to rebuild with a new pair of keys.

Public Key Infrastructure (PKI), also known as public-key infrastructure, is a system of technologies, rules, and services for managing digital certificates and encryption keys, enabling secure identity verification of individuals and organizations on the internet and providing encrypted communication.

SAN stands for alternative name in a TLS certificate extending the validity of the certificate with other domain names. These names may not be related to the main domain (Common name) and can be an internal server names or private IP addresses. More about SAN certificates, refer to the separate page, which also contains examples of the use of SAN names.

A communication protocol that allows IoT devices to automatically request and obtain a digital certificate from a certificate authority without the need for manual installation by an administrator.

SNI (Server Name Indication) is a method that allows using multiple domains and TLS certificates on one webserver with one IP address. With SNI the server is able to connect the client to the right server the client wants to see, and send them the correct TLS certificate for the correct domain. Without SNI support browser will receive random certificate and this will cause an error; the server does not know the customer's preference.

The SSL protocol was discontinuited, see a TLS protocol below.

When you establish a connection with the server with your browser through HTTPS protocol, it is necessary to arrange the details of communication, especially the depth and ciphersuite of encryption. This "dialog" is called "SSL/TLS handshake". In the end the server sends the TLS certificate to the customer and he can start to encrypt and transfer data. The connection is set.

TLS is a communication protocol which is replacing the old SSL protocol. Both protocols work similarly, but using the TLS protocol is more secure and still used; SSL protocols are depreciated.

The UC (Unified Communication) certificate is a synonymum for a SAN certificate. This name is used mainly by software manufacturers (Microsoft). The function is the same as a SAN certificate.

A public key (CSR) is required for issuing a TLS certificate. This public key (or CSR request) will be generated by the administrator of your website (or webhosting company) on the server where the domain for which the TLS certificate is issued is located. You can also create it in SSLmarket order or in order details.

For more information and how to generate a public key, see an article about the public key.

A Wildcard TLS Certificate allows you to secure all subdomains under one main domain. A Wildcard certificate contains the asterisk before the domain (eg. *.sslmarket.com) and covers all subdomains on the asterisk place (subdomains of higher domain). Find more information about Wildcard certificates in Wildcard certificates section.

X9 PKI is a standardized PKI defined by the American financial organization ANSI X9, used mainly in the banking and financial sector to secure payment transactions, key exchange, certificates, and electronic signing between institutions.

To order an X9 PKI certificate and for more information click here.