Types of TLS certificates (and how they relate to SSL)

TLS (Transport Layer Security) is the modern protocol family that replaced legacy SSL versions. A “TLS certificate” is the X.509 credential a server presents during the handshake. This article explains TLS certificate types in protocol-aware language — without pretending SSL and TLS are two different products you must purchase twice.

SSL vs TLS naming (stop buying twice)

Vendors say SSL; browsers speak TLS (1.2/1.3 in practice). The certificate is the same class of object. If you landed here from a TLS search, the practical buyer’s guide matches our SSL certificate types article — validation (DV/OV/EV), name coverage (single/SAN/wildcard), and specialty non-web certs.

Server authentication certificates

These bind a public key to a hostname (SAN). Clients verify the chain to a trusted root and that the name matches. That is HTTPS for websites and APIs. docstoc automates DV server certificates from Let's Encrypt for your domain.

Client authentication certificates

Used in mTLS so the client proves identity too. Common in enterprise APIs and device fleets — not a substitute for public website DV.

Short-lived TLS certificates

Industry direction is shorter lifetimes. Let's Encrypt popularized ~90-day DV certificates; CA/Browser Forum Ballot SC-081v3 now schedules industry-wide maximums down to 47 days by March 2029 (after 200-day and 100-day steps). Shorter life reduces the damage window if a key leaks — and makes automation mandatory. See the canonical guide: 47-day SSL certificate lifetime schedule and ACME automation.

Where TLS fits in docstoc

Use the TLS product page for the conversion-oriented overview, SSL for the classic search wording, and comparison pages like Cloudflare SSL when your edge architecture differs from origin issuance.

FAQ