Use
Every certificate exists to answer one question about identity.
Start from the question, not the product name. The use case determines the lifetime, the automation path, and what breaks when it fails.
Websites and APIs (TLS)
A publicly trusted server certificate binds a domain name to a key pair, and the handshake proves possession of the private key.
- Certificate type
- Public TLS server certificate (DV / OV / EV)
- Protocols
- TLS 1.2, TLS 1.3, QUIC, HTTP/2, HTTP/3
- Typical lifetime
- 398 days today, falling to 47 days by 15 March 2029
- Automation path
- ACME (RFC 8555) with HTTP-01, DNS-01 or ALPN-01 challenges
- Primary failure mode
- Expiry, missing intermediate, name mismatch, or a chain the client cannot build
- Post-quantum note
- Hybrid key exchange (X25519MLKEM768) is already deployable; signatures remain classical.
Pattern
The same four questions, every time
Who is being identified?
A domain, a service, a person, a device, a publisher, or a workload. This determines validation.
Who accepts the identity?
A public trust store, an internal trust bundle, or a single application. This determines the issuer.
How long should it live?
Exposure window versus operational cost. Shorter is safer only when renewal is unattended.
What happens when it fails?
Outage, silent trust loss, or unverifiable history. This determines monitoring priority.