Overview: Certificate validation and lifecycle
Certificate validation and lifecycle connect public identity evidence, trust paths, requested names and deployed certificate state.
A certificate has to fit the requested service identity and lead through an acceptable validation path. Renewal also has to produce the certificate actually served to a new connection. These topics separate certificate contents, trust, name matching and deployment lifecycle so each observed failure can be located.
TLS certificates
A TLS certificate binds public-key and service-identity information within a signed certificate structure whose usage, validity and trust must be evaluated by the client.Certificate trust chains
A certificate trust chain links endpoint evidence through valid issuer relationships to a client-trusted anchor, with path validation separate from service-name matching.Certificate hostnames
Certificate hostname validation compares the requested service identity with appropriately typed certificate names, keeping wildcard scope and direct IP identities distinct.Certificate renewal and ACME
Certificate renewal obtains and deploys successor TLS evidence through distinct validation, issuance, installation and endpoint-reload stages, which ACME can automate in part.