Certificates

X.509 documents bind DNS names or service identities to public keys for TLS handshakes and optional mutual TLS. Operators renew before expiry to avoid browser warnings and broken APIs. Private keys stay on instances or self-managed reverse proxies while public chains validate trust.