The terms you'll run into across every other guide on this site, in one place.
An organization trusted by browsers and operating systems to verify identity and issue certificates — e.g. Let's Encrypt, DigiCert, Sectigo.
An encoded request, generated on your server, containing your public key and domain details, submitted to a CA to obtain a certificate.
The path from your certificate up through one or more intermediate certificates to a root certificate that's built into browsers and operating systems.
The specific combination of encryption, authentication, and key-exchange algorithms negotiated between browser and server for a session.
The negotiation process at the start of a TLS connection where the browser and server agree on protocol version, cipher suite, and exchange keys.
HTTP Strict Transport Security — a header that tells browsers to only ever connect to your site over HTTPS, even if a user types http://.
A certificate that sits between your certificate and the root CA in the chain of trust, signed by the root and used to sign end-entity certificates.
A page loaded over HTTPS that also loads at least one resource — script, image, stylesheet — over plain HTTP.
Online Certificate Status Protocol — a way for browsers to check in real time whether a certificate has been revoked.
The secret half of a certificate's key pair, kept only on your server, used to decrypt data and prove ownership of the certificate.
A self-signed certificate at the top of the chain of trust, pre-installed in browsers and operating systems as an inherently trusted anchor.
A field listing every domain and subdomain a certificate is valid for — required by modern browsers even for a single-domain certificate.
A TLS extension letting a server know which hostname the client wants, so multiple certificates can be served from a single IP address.
A certificate covering a domain and all of its first-level subdomains using a single entry, e.g. *.yourdomain.com.