Digital Certificate

A digital certificate is an electronic credential that links a public key to the identity of its owner, such as a bank, a website, a payment terminal or an individual. The certificate is signed by a certificate authority (CA), an organisation that others trust to check identities before issuing certificates. Anyone receiving the certificate can verify the CA's signature and so trust that the public key really belongs to the named owner. Certificates are the foundation of public key infrastructure (PKI), which secures most online banking, payments and data exchange.

The most widely used format is X.509, defined by international standards bodies. A certificate typically contains the owner's name, the public key, the issuing CA, a serial number, validity dates and the CA's digital signature. The matching private key is kept secret by the owner and, in financial services, is often stored in a hardware security module.

Trust flows through a chain. Root CAs hold self-signed certificates that are pre-installed in browsers, operating systems or payment systems. Root CAs sign certificates for intermediate CAs, which in turn sign certificates for end users. When a system receives a certificate, it checks each signature up the chain to a trusted root, confirms the certificate has not expired and checks whether it has been revoked, using revocation lists or online status checks. If all checks pass, the system can use the public key to encrypt data for the owner or to verify the owner's signatures.

• Secure websites and APIs. Transport Layer Security (TLS) uses server certificates so that customers and partners can confirm they are connected to the genuine bank or payment provider and that traffic is encrypted.
• Mutual authentication. In mutual authentication, both client and server present certificates. Payment APIs, interbank links and corporate banking connections commonly require this.
• Open banking. Under PSD2, third-party providers identify themselves to banks using qualified certificates issued under the EU's eIDAS Regulation: qualified website authentication certificates (QWACs) for securing connections and qualified electronic seal certificates (QSealCs) for signing messages. The certificates carry the provider's authorisation number and roles. In the UK, the open banking directory issues its own certificates for the same purpose.
• Card payments. In EMV, card schemes act as certificate authorities. Issuers' public keys are certified by the scheme, and chip cards carry certificates that terminals use to verify card data offline, supporting EMV transactions.
• Message signing. Payment messages, files sent to banks and instructions in systems such as SWIFT are signed using certificate-based keys to prove origin and integrity.
• Document and identity signing. Qualified certificates support legally recognised electronic signatures on contracts and account opening documents.

Certificates have a limited life, after which they must be renewed. Managing this lifecycle is a significant operational task for financial firms with thousands of certificates across systems. Steps include generating key pairs securely, requesting and validating certificates, installing them, monitoring expiry dates, renewing them and revoking them if keys are compromised or staff leave. Expired certificates are a common cause of outages, as connections fail when a certificate passes its end date. Good key management and regular key rotation reduce the risk of compromise.

The certificate system is only as strong as its CAs. If a CA is compromised or issues certificates carelessly, attackers can obtain certificates for domains they do not control and impersonate them. Browser makers and industry bodies have removed trust from CAs that breached rules. Theft of a private key allows an attacker to impersonate the owner until the certificate is revoked, and revocation checking is not always reliable. Weak algorithms or short key lengths can become vulnerable over time, which is why standards regularly raise minimum requirements. Looking ahead, the development of quantum computers threatens widely used public key algorithms, and standards bodies have begun publishing post-quantum algorithms that certificates will eventually need to use.

In the EU, the eIDAS Regulation sets rules for qualified trust service providers, which must be supervised and listed on national trusted lists. Public web certificates follow baseline requirements set by an industry forum of CAs and browser makers. Payment card and terminal security standards, including PCI requirements and EMV specifications, set rules for how certificates and keys are used in card systems. Banks also apply internal standards and audits to their own PKI.