What TLS actually does — and why a browser trusts your certificate
Every padlock icon in a browser address bar represents a negotiation that happens in milliseconds, before a single byte of your page loads. Here is what actually happens, and what can go wrong.
"SSL" and "TLS" are (mostly) the same conversation
SSL (Secure Sockets Layer) is the original protocol from the 1990s; TLS (Transport Layer Security) is its modern successor, and every version of SSL has been formally deprecated for over a decade. Almost nobody actually runs SSL today — but the name stuck in everyday language ("SSL certificate", "SSL Monitor") the way "dial" stuck around after phones stopped having dials. When people say SSL now, they mean TLS in practice.
The handshake, in three steps
1) The client (a browser, an API caller, a mobile app) connects and says which TLS versions and cipher suites it supports. 2) The server picks a version and cipher both sides support, and sends its certificate — a signed statement of "I am example.com, and here is my public key." 3) The client verifies that certificate against a chain of trust back to a root certificate authority it already trusts, and if everything checks out, both sides derive a shared encryption key and the actual encrypted connection begins.
That verification step is where most real-world problems live: an expired certificate, a chain missing its intermediate links, or a certificate that simply doesn't match the domain being visited will all cause step 3 to fail — and browsers correctly treat that as a hard stop, not a warning to click past.
Why certificate lifetimes keep shrinking
Certificates used to last years; the industry norm for many issuers is now 90 days, and shorter lifetimes are an explicit direction from browser vendors. The reasoning: a shorter validity window limits how long a compromised or mis-issued certificate can be abused, and it forces renewal to be automated rather than a once-every-few-years manual task that everyone has forgotten how to do by the time it comes around again. The tradeoff is that automation failures now show up much faster — which is exactly why continuous monitoring matters more than it used to.