Glossary

Last updated: December 1, 2025
See all Documentation

Baseline Requirements (BRs): A set of technical and policy requirements for CAs. Since all Root Programs incorporate the Baseline Requirements, CAs must adhere to them to be trusted by most browsers.
CA Issuers: Part of the AIA field containing information about the issuer of the certificate. It may be useful when the web server didn’t provide a trusted certificate chain.
CA/Browser Forum: A voluntary group of certification authorities, vendors of Internet browser software, operating systems, and other PKI-enabled applications. The CA/Browser Forum publishes the Baseline Requirements. Wikipedia
CAA (Certificate Authority Authorization): A type of DNS record that specifies which CAs are allowed to issue certificates for a domain. CAA records are respected by CAs, not checked by browsers.
Canonical Name record (CNAME): A DNS entry which maps one domain name to another, referred to as the Canonical Name. Wikipedia
Certificate: A file in a particular format that contains a public key and other data describing when to use that public key. The most common kind of certificate is a leaf certificate. There are also intermediate and root certificates.
Certificate Authority (CA): An organization that issues certificates. IdenTrust, Sectigo, and DigiCert are Certificate Authorities. Wikipedia
Certificate Policy (CP): A named set of rules that indicates the applicability of a certificate to a particular community and/or class of applications with common security requirements. Specific details of issuance are outlined in a CPS. CP and CPS documents may be combined into a single document. ISRG Combined CP/CPS - RFC 3647 - Wikipedia
Certificate Revocation List (CRL): A method to inform user agents about the revocation status of a certificate. This is a list of the serial numbers of all revoked certificates from a given CA, signed by that CA. Wikipedia
Certificate Signing Request (CSR): A signed file containing the needed information required by the CA to generated a certificate. Relevant information includes Common Name, Subject Alternative Names, and Subject Public Key Info. Wikipedia
Certificate Store: A certificate store contains a list of trusted roots. Operating systems (such as Windows, Android or Debian) and web browsers (such as Firefox) maintain a certificate store. Browsers without one rely on the operating systems’ certificate store.
Certificate Transparency Log: A component of Certificate Transparency that accepts submissions of certificates and precertificates and incorporates them into a permanent, verifiable, publicly-accessible list.
Certificate chain: A list of intermediate certificates that help a user agent determine that it can trust an end-entity or leaf certificate, by connecting it to a root certificate in its certificate store. Note: the chain is not always unique, and when a website presents a certificate chain leading to one root, the user agent may decide to use another chain to validate the certificate. Wikipedia
Certificate extension: In certificates, most fields are defined by extensions. For instance, Subject Alternative Names and AIA are extensions. The extension mechanism allows creating new fields that were not part of the original X.509 standard.
Certificate issuer: The “Issuer” field of a certificate describes which certificate signed it. It commonly contains fields like Common Name, Country, and Organization. The Issuer field always matches some certificate’s Subject field. For self-signed certificates like roots, the Issuer is the same as the Subject. The term “issuer” may also be used to indicate a certificate that issues other certificates (an intermediate or root), or an organization that issues certificates.
Certificate subject: The “Subject” field of a certificate field indicates what a certificate is about. This commonly contains fields like Common Name, Country, and Organization.
Certification Practice Statement (CPS): A statement of the practices that a certification authority employs in issuing, managing, revoking, and renewing or re-keying certificates. A CPS must be compliant with its associated Certificate Policy. CP and CPS documents may be combined into a single document. ISRG Combined CP/CPS - RFC 3647 section 3.4 Wikipedia
Common Name (CN): Part of a certificate’s Subject describing what the certificate is about. For roots and intermediates it’s the human-readable name of the certificate authority. For leaf certificates it’s one of the domain names on the certificate. Note: The common name is limited to 63 characters. It is an obsolete method of indicating a domain name to which the certificate applies, since current Internet standards expect software to check only the Subject Alternative Names in order to determine the applicability of a certificate.
Critical extension: A certificate may contain extensions marked “critical.” This means that software must reject that certificate unless the software understands how to process that extension. This makes it possible to introduce new extensions that are important for security without creating risks for older software.
DNS-based Authentication of Named Entities (DANE): A mechanism using DNS to indicate how to verify the authenticity of the certificate or encryption key presented. Wikipedia
Domain Name System Security Extensions (DNSSEC): A mechanism to cryptographically authenticate DNS responses. DNSSEC requires deployment by TLDs, domain name owners, and recursive resolvers in order to take effect. Adoption is currently somewhat low. Wikipedia
ECDSA (Elliptic Curve Digital Signature Algorithm): A variant of the Digital Signature Algorithm (DSA) which uses elliptic curve cryptography. Wikipedia.
Ed25519: A specific type of EdDSA, along with Ed448.
EdDSA (Edwards-curve Digital Signature Algorithm): A modern public-key signature system based on elliptic curves, designed to solve several common implementation issues with elliptic curve cryptography. Wikipedia
Elliptic Curve Cryptography (ECC): An type of public-key cryptography based on elliptic curves. ECC uses smaller keys compared to non-EC cryptography while providing equivalent security. Cloudflare - Wikipedia
Fully qualified domain name (FQDN): The complete domain name of a website. For example, www.example.com is an FQDN.
HTTP Public Key Pinning (HPKP): A security mechanism that asks a browser to require that a site’s certificate chain use certain public keys on future loads. Chrome introduced this mechanism to protect against CA compromises, but it caused site outages, leading Chrome to deprecate and remove it. Wikipedia
Intermediate certificate: A certificate signed by a root or another intermediate, and capable of signing other certificates. They are used to sign leaf certificates while keeping the private key of root certificate offline. Intermediates are included in certificate chains. Wikipedia
Internationalized Domain Name (IDN): Domain name with characters others than a to z, 0 to 9 and the hyphen (-). They can for example contain Arabic, Chinese, Cyrillic, Tamil, Hebrew or Latin alphabet-based characters with diacritics or ligatures. The encoded representation of an IDN domains starts with xn--. Wikipedia - RFC 5890 - RFC 5891
Internationalized Domain Names for Applications (IDNA): See internationalized domain name.
Key-pair: A combination of a private key and public key used to sign or encrypt. The public key is commonly embedded in a certificate, while the private key is stored on its own and should be kept secret. A key pair can be used to encrypt and decrypt, to sign and verify data, or to negotiate secondary keys, depending on the application. Wikipedia
Leaf certificate (end-entity certificate): Most commonly, a certificate signed by an intermediate, valid for a set of domains and not able to sign other certificates. Wikipedia
Mixed content: When an HTTPS webpage loads sub-resources (Javascript, CSS or images) over HTTP. Browsers may block mixed content, or mark the page as less secure when mixed content is present: https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content. To fix a mixed content problem, a web developer must change their pages so all resources use HTTPS URLs. Developer tools built into browsers can be used to find out which resources are causing mixed content problems.
OCSP (Online Certificate Status Protocol): A method to check the revocation status of a certificate. In other words, a way to check whether a Certificate Authority indicates that the certificate should no longer be considered valid, even though its expiration date has not yet been reached. This request can create privacy problems because it allows the certificate authority, and Internet service providers, to directly observe who is visiting which sites. Wikipedia
OCSP Must-Staple: A certificate extension, informing the browser that the web server with that certificate must use OCSP stapling. It’s used to require that an up-to-date revocation status of the certificate is confirmed by the web server on every connection, making revocation more reliable. RFC 7633
OCSP stapling: A way for a web server to send a browser an OCSP response signed by the Certificate Authority, so the browser itself doesn’t need to make a secondary OCSP request to the CA, improving speed and privacy. Also known as TLS Certificate Status Request extension. Wikipedia Cloudflare
Object identifier (OID): OIDs are unique numeric identifiers standardized by the International Telecommunications Union (ITU) and ISO/IEC. OIDs are used within certificates to define extensions, fields, or policy assertions. Internet standards and Certificate Policy and Certification Practice Statement documents define OID usage. Wikipedia
Organization Validation (OV): Certificates for which the CA has verified the legal entity of the Subscriber. They contain information about that entity. Wikipedia
PEM file (.pem): A format for cryptographic information (originally specified as part of the Privacy Enhanced Mail Internet standards for secure email). A PEM document can represent information such as a private key, a public key, or a digital certificate. These files start with “-----BEGIN " and then a data type. Wikipedia
Personal Information Exchange Files (.pfx): A file that may contain a leaf certificate, its chain up to the root and the private key of the leaf. See also https://en.wikipedia.org/wiki/PKCS_12. Microsoft Hardware Dev Center
Precertificate: Precertificates are a part of Certificate Transparency. A precertificate is a copy of the certificate that a CA intends to issue, with a critical poison extension added to prevent the precertificate from being accepted by software in the wild. A CA submits a precertificate to CT logs in exchange for SCTs. Since a precertificate is not identical to its corresponding certificate, Certificate Transparency logs may end up containing both. RFC 6962 Section 3.1
Profile: A Profile is a collection of properties which affect both the validation of and final contents of a certificate. See the profiles documentation for descriptions of each profile, what they affect, and how to select them.
Public Suffix List (PSL): A list of Public Suffixes maintained by Mozilla, indicating which Internet domains are available for many separate entities to register subdomains. For instance, the list indicates that both com and co.uk are Public Suffixes even though co.uk is not a TLD. Web browsers use the list, among other things, for preventing sites that are likely operated by different entities from sharing web cookies with one another. https://publicsuffix.org/
RSA: A public-key algorithm used for encryption and to digitally sign certificates. Wikipedia
Relying Party: The person relying on information in a certificate. For instance, someone who visits an HTTPS web site is a Relying Party.
Revocation: A certificate is valid until its expiration date, unless the CA says it has been revoked. The certificate may be revoked for various reasons such as the compromise of the private key. Browsers may check if a certificate is revoked using a CRL or newer methods like CRLite and CRLSets. Note that in many situations, revocation doesn’t work. /docs/revoking
Root Program: The policies an organization uses to decide which certificates to include in its certificate store, and thereforce which CAs are trusted by their software.
Root certificate: A self-signed certificate controlled by a certificate authority, used to sign its intermediate certificates and included in certificate stores. Wikipedia
SSL (Secure Sockets Layer): An older name for TLS, still in common use.
Self-signed certificate: A certificate signed by its own private key, with its Subject equal to its Issuer. Self-signed certificates are trusted only due to prior arrangements made in the physical world, such as inclusion on a trusted root list. Root certificates are self-signed. Wikipedia
Server Name Indication (SNI): A field that a user agent sends to a server during a TLS handshake, specifying the domain name to connect to. This allows the server to answer with the appropriate certificate when multiple domains are hosted behind the same IP. The web server might send a different certificate, and show different content, depending on the name that the client requested by SNI. SNI is not encrypted, but an experimental replacement, ESNI, is. Wikipedia
Signed Certificate Timestamp (SCT): A signed, verifiable promise to publish a certificate, from a Certificate Transparency log. Browsers that enforce CT check for the presence of SCTs in a site’s certificate, or in the TLS handshake, and refuse to connect to sites that don’t meet their logging requirements. This increases the likelihood that fraudulent or inaccurate certificates will be detected. https://www.certificate-transparency.org/how-ct-works
Subject Alternative Name (SAN): A field of a certificate that indicates for which domain(s) the certificate is valid. It replaces the usage of the Common Name, which is now provided for compatibility reasons only. A single certificate may contain many SANs and be valid for many different domain names. Wikipedia https://letsencrypt.org/docs/rate-limits/#names-per-certificate
Subscriber: The person or organization requesting a certificate.
TLS (Transport-Level Security): The protocol used by HTTPS to encrypt and authenticate web page visits.
TLSA: The part of DANE specifically related to validating TLS connections.
Top-Level Domain (TLD): Highest level in the hierarchical Domain Name System, such as country-code top-level domains (ccTLDs) like .de (Germany), .cn (China) and generic top-level domains (gTLDs) like .com, .org. Wikipedia
Unified Communications Certificate (UCC): A description of a certificate containing multiple Subject Alternative Names (SANs).
User Agent: Software capable of communicating with a web server. Example: a web browser or cURL.
Web Browser: A user agent used to display web pages. Examples: Mozilla Firefox, Google Chrome or Safari. Wikipedia
Web server: Software serving web pages (or, by extension, the hardware server hosting it). Wikipedia
Wildcard Certificate: Certificates valid for subdomains one level deep. For instance, a certificate containing a SAN for *.example.com is valid for blog.example.com and www.example.com but not for bork.bork.example.com or example.com). A wildcard is indicated by an asterisk character (*) in place of a subdomain. Wikipedia
X.509: The standard defining the format of public key certificates. Wikipedia