Learning Forever

3. The Partial Understanding Problem. Would You Ship What You Only Partially Understand?

A critical tension emerges in AI assisted development. Teams can now generate large portions of a system they only partially understand. In my experience, engineers may truly understand only a fraction of what an AI agent produces, especially when working at high velocity.This raises a fundamental question.

What Is a Digital Certificate?

A digital certificate is a signed document that binds a public key to an identity. Think of it as a cryptographic passport. It does not just contain a key — it attaches that key to a name, an organisation, and a validity window, all stamped by a trusted authority called a Certificate Authority (CA).

Public Key vs Certificate — Are They the Same Thing?

This is a common point of confusion. They are different things, but closely related: the certificate contains the public key, plus a great deal more. A public key alone is identity-less. It is just a number. Anyone could generate one and claim it belongs to google.com. The certificate is what binds that key to an identity — and the CA's signature is what makes that binding trustworthy.

What Does a Digital Signature Actually Sign?

This is where most explanations become vague. There are actually two distinct signatures in every TLS connection, and it is important to understand both. Signature 1 — The CA Signs the Certificate (once, at issuance) When DigiCert issues a certificate to login.example.com, it does not just sign the public key.

How to Tell if a Server Requires mTLS?

The simplest test is to try connecting without a client certificate. If the connection succeeds, it is plain HTTPS. If the TLS handshake fails or returns an HTTP 400 error, the server is requiring a client certificate.