Qraft

SSL Certificate

Last updated:

An SSL certificate (technically TLS certificate) authenticates a website operator's identity through a Certificate Authority (CA) and encrypts browser-server communication. Valid certificates enable https:// URLs, and the address-bar icon (its exact shape varies by browser and version) opens the certificate details.

QR codes linking to HTTP sites without SSL certificates create two problems: unencrypted communication risks data interception, and browser warnings cause user abandonment. HTTPS is mandatory for QR code link destinations.

Three validation levels exist: DV (domain ownership only, free via Let's Encrypt), OV (organization verification), and EV (strictest validation; the organization name it carries sat in the address bar until Chrome 77 and Firefox 70 moved it behind the address-bar icon in 2019). QR code payment and financial service destinations should use OV or higher.

SSL certificates alone don't guarantee safety - attackers obtain DV certificates for HTTPS phishing sites. Verifying the domain name after scanning remains essential.