We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design Masterclass · Security Architecture
Free preview: the first 2 parts of this 5-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Security Architecture
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
An attacker registered yourbank-secure.com, cloned your bank's website pixel-for-pixel, and sent phishing emails directing customers to it. Without TLS certificates, there would be no way to distinguish the real site from the fake one. But your bank has an SSL/TLS certificate issued by a trusted Certificate Authority (CA) that proves the server at yourbank.com is operated by Your Bank, Inc. The browser verifies this certificate and shows the padlock icon. The phishing site either has no certificate or has one for a different domain, and the browser warns the user.
TLS certificates are the identity layer of the internet. They answer the question: "Am I actually talking to who I think I'm talking to?" Without them, encryption alone is insufficient because you could be establishing an encrypted connection to an attacker.
In January 2021, Let's Encrypt reported issuing over 1 billion certificates since its launch in 2015. That single organization pushed adoption from roughly 40% of web page loads to over 80% by making certificates free and automated.
Not all certificates are created equal. The type you choose determines what level of identity verification backs the padlock icon.
Domain Validated (DV) certificates prove only that you control the domain. The CA sends a challenge to a record or a specific URL path, you respond, and the cert is issued in seconds. Let's Encrypt, Cloudflare, and AWS Certificate Manager all issue DV certs. Cost: free to $20/year.
Organization Validated (OV) certificates require the CA to verify that your organization actually exists. They check business registration documents, phone numbers, and physical addresses. The process takes 1-3 days. OV certs show the organization name in the certificate details but not in the browser address bar. Cost: $50-200/year.
Extended Validation (EV) certificates require the most rigorous checks. The CA verifies legal existence, operational existence, physical address, and that the applicant has authority to request the certificate. EV used to show a green address bar with the company name, but browsers removed that UI in 2019 because research showed users did not notice it. Cost: $200-1,000/year.
For most applications, DV is sufficient. If your users need assurance of organizational identity (banking, healthcare, government), consider OV. EV provides marginal benefit over OV since browsers stopped displaying the company name prominently.