Digital certificate
A digital certificate is an electronic document awarded to a person as evidence of an achievement, though the same phrase also names an unrelated piece of internet infrastructure, which is why searches for it return two different subjects.
Last updated
Two unrelated things share this name
Searching for "digital certificate" returns two subjects with almost nothing in common, and which one you want changes the entire answer.
- An award document. An electronic certificate given to a person for completing a course, passing an assessment, or attending a programme. This is the sense used everywhere else on this site.
- An X.509 certificate. A file that binds a public key to an identity, usually a website's domain name, issued by a certificate authority and used to secure connections over TLS. The padlock in a browser's address bar is one of these.
They are not variations of one idea. They are separate technologies with separate standards that happened to end up with the same everyday name. If you are here about HTTPS, a website's certificate, or a certificate authority, this is the wrong page and the rest of it will not help.
The award document
In the credentials sense, a digital certificate is the document-shaped form of a digital credential: it looks like a certificate, names a recipient and an achievement, and is designed to be recognisable as such at a glance. That recognisability is the point. People know what a certificate is, which is why the format survives.
What varies enormously is what sits behind it. Three things get called digital certificates and they are not equivalent:
- A scan or export of a paper certificate. A picture. Proves nothing beyond what the picture shows, and is trivially edited.
- A generated PDF, produced in bulk from a template and a list. More consistent, still a file, still unverifiable once it leaves the issuer.
- A hosted, signed credential: a permanent page carrying a digital signature, with the PDF as one downloadable representation rather than the thing itself.
Only the third changes what a recipient can prove. The first two change how the certificate is delivered.
Certificate, certification, qualification
Three words that get used interchangeably and should not be.
- A certificate is the document. It records that something happened, often just attendance or completion. See certificate of completion.
- A certification is the status of having been assessed against a defined standard by a body that maintains it, usually with an expiry and a renewal requirement. The certificate is the evidence; the certification is the thing itself.
- A qualification is typically awarded by an educational institution and recognised within a formal framework, which certificates and certifications generally are not.
Employers reading CVs know the difference, whether or not they use the words precisely. Overstating which one you hold is one of the things that makes an otherwise genuine credential look suspect. Spotting a fake certificate covers how that reads from the other side of the desk.
Do the two meanings ever touch?
Loosely, and it is worth knowing why the collision is not a total coincidence. Both rest on public-key cryptography: an X.509 certificate binds a key to a domain so a browser can trust a connection, and a signed award credential binds a claim to an issuer's key so a stranger can trust the claim. Same underlying mathematics, entirely different problem. Ours signs credentials with Ed25519. The security page has the detail.
Related terms
- Digital credential
A digital credential is a claim about a person, such as a qualification, a skill, a membership, or an attendance, issued in a form that can be checked electronically rather than taken on trust.
- Digital signature
A digital signature is a value computed from a document and a private key, which anyone holding the matching public key can use to confirm that the document has not changed since it was signed and that it was signed by the holder of that key.
- Certificate of completion
A certificate of completion confirms that someone finished a course or programme, without asserting that they were assessed against a standard or reached any particular level of competence.