Digital certificates in network security usually mean public-key certificates, not course-completion certificates. A public-key certificate binds a public key to a subject under an issuer’s policy. An achievement credential records what an institution says a learner earned. They solve different problems, even when both use digital signatures.
What a public-key certificate contains
An X.509 certificate includes a subject, issuer, public key, serial number, validity interval and extensions such as permitted key uses and subject alternative names. The issuing certificate authority signs it. A relying system checks the signature chain, hostname or intended identity, validity, permitted use and applicable revocation information against its trust policy. A valid certificate does not mean the website’s content is honest or the software is harmless.
Common certificate types
| Type | Institutional use | Important boundary |
|---|---|---|
| TLS server certificate | Authenticate the server and support HTTPS transport security | Does not prove a course award or the truth of a website |
| Client certificate | Authenticate a device or account to a configured service | Access permissions and identity enrollment remain separate |
| Code-signing certificate | Verify publisher signature and detect changes to signed software | Signed software can still contain vulnerabilities or malware |
| S/MIME certificate | Support email signing or encryption in compatible clients | Key management and recipient compatibility are required |
| CA certificate | Establish a root or intermediate in a trust chain | Trust is determined by the relying system, not by the certificate alone |
A digital signature proves integrity relative to a signing key. A certificate supplies a policy-governed binding for that key. Signing is not the same as encrypting: modern TLS negotiates session keys; it does not simply encrypt every message with the certificate’s public key. See RFC 5280’s certificate profile and the TLS 1.3 protocol.
DV, OV and EV are validation categories—not encryption strengths
Domain Validation checks domain control. Organization Validation additionally checks organizational information. Extended Validation applies a more extensive identity-validation policy. With comparable keys and TLS configuration, these categories do not provide progressively stronger traffic encryption. Do not choose EV on the promise of a green address bar or treat any browser indicator as proof that a business is trustworthy. Use maintained browsers, endpoint protection, updates and safe download practices regardless of certificate type.
“Class 1/2/3” is not a universal classification for modern public-web TLS. Where a jurisdiction or signing provider uses classes, request its current certificate policy and identity-assurance requirements rather than assuming a global ladder.
Renewal requirements have changed
The CA/Browser Forum TLS Baseline Requirements limit newly issued publicly trusted TLS subscriber certificates to 200 days from 15 March 2026, with further scheduled reductions. This is not a rule for every private PKI or every certificate purpose. IT teams should inventory endpoints, automate renewal where supported, monitor failures, protect private keys and test revocation procedures. Expiration does not undo damage from a compromised key.
Who issues which certificate?
Public TLS CAs such as Let’s Encrypt and DigiCert issue under browser-trust policies. An organization may operate a private CA for its own trusted systems. CertifyMe is an achievement-credential platform, not a public TLS certificate authority. Evaluate PKI tooling with IT/security; evaluate digital credential infrastructure with the academic or programme owner. For issuer, holder and verifier responsibilities in achievement records, read the W3C Verifiable Credentials guide.
A university may need both: HTTPS for its credential pages and governed, verifiable awards for learners. One does not substitute for the other. Discuss an achievement-credential workflow only after defining what the institution is authorized to recognize.
Frequently Asked Questions
Is CertifyMe a TLS certificate authority?
No. CertifyMe supports achievement credentials. Use an appropriate public or private PKI provider for TLS, client authentication or code signing.
Does EV encrypt data more strongly than DV?
Not merely because it is EV. DV, OV and EV describe validation scope; encryption strength depends on keys, protocol and configuration.
How long can a new publicly trusted TLS certificate last?
From 15 March 2026, the CA/Browser Forum maximum is 200 days for newly issued public TLS subscriber certificates. Other certificate types and private trust systems may have different policies.
