# SSL certificates

> What SSL/TLS encryption protects, what a certificate proves, and how Coritan issues and renews certificates for your names.

Source: https://www.coritan.com/docs/learn/ssl-certificates/

When a browser opens an `https://` address, the browser and the server encrypt everything they send each other, so nobody on the network between them can read it or change it. The encryption is called *TLS*, and people still use *SSL*, the name of the older version it replaced. Mail apps use the same encryption to talk to a mail server.

## What a certificate proves

Encryption alone does not tell the browser who is at the other end. A *certificate* does. It is a file that says a server may answer for a name, such as `www.example.com`, signed by a *certificate authority* that browsers trust. Without a valid certificate for the name, the browser warns visitors before it shows the page.

A certificate lasts a limited time, so it has to be renewed before it expires.

## How an authority checks a name

Before an authority signs a certificate, it asks for proof that whoever asked controls the name, in one of two ways:

*DNS validation*
: A `TXT` record with a value the authority chooses, published under the name in DNS.

*HTTP validation*
: A file with a value the authority chooses, served by the website at a path the authority sets.

The proof has to work again at every renewal, so the method you choose decides whether renewal can happen without you.

## Certificates at Coritan

- Coritan gets certificates from public certificate authorities and does not charge for them. Each certificate covers one name, so `example.com` and `www.example.com` each get their own.
- Coritan's edge serves the certificate for each name that has a web proxy. A new web proxy asks for its certificate by itself ([Web proxies, origins and the WAF](/docs/learn/web-proxies/)).
- When Coritan hosts the domain's DNS, it adds and removes the validation record for you. Coritan renews an active certificate once it has 30 days or less left ([How SSL/TLS certificates work](/docs/websites/ssl/)).
- A certificate validated with a record you added at another DNS provider cannot renew by itself, because each renewal needs a new value that Coritan cannot publish there ([Renewal](/docs/websites/ssl/#renewal)).

## Next steps

- [Put a website online](/docs/get-started/put-a-website-online/), with a certificate from the start
- [Issue an SSL/TLS certificate](/docs/websites/ssl/issue-a-certificate/)
- [Create a web proxy](/docs/proxies/web-proxies/create-a-web-proxy/)