What is an SSL certificate, concretely?

What is an SSL certificate, concretely?

When you "install a certificate," what file are you actually installing? Not a license or a subscription — a signed data structure. An X.509 certificate (the format defined in RFC 5280) is essentially your public key plus identity fields, wrapped in a signature from a Certificate Authority (CA).

The core fields, in plain terms:

— Subject: the domain(s) it covers, in the Subject Alternative Name extension (the Common Name field is deprecated; browsers stopped reading it years ago)
— Public key: the half of your key pair that travels publicly
— Issuer + signature: the CA vouching that the public key belongs to that domain
— Validity window: notBefore / notAfter dates

Critically, the certificate contains your public key. Your private key never leaves your server and is never inside the certificate. If someone obtains only the .crt/.pem file, they have learned nothing secret — that file is meant to be handed to every visitor.

The CA's signature is the whole trust mechanism: your browser already trusts a few hundred root CAs shipped by the OS/browser vendor, so it trusts anything they sign down the chain.

Further reading: RFC 5280 (Internet X.509 Public Key Infrastructure).

Bottom line: a certificate is a CA-signed binding of "this public key = this domain." Public by design; the secret stays on your server.