TLS certificate
A signed file binding a public key to one or more host names, which a server presents during the TLS handshake to prove its identity.
What it means
Certificates follow the X.509 format: a public key, the names it is valid for (in the Subject Alternative Name extension), a validity period and the signature of the issuing certificate authority. A client trusts it if it chains to a root it trusts, has not expired and names the host it connected to.
In mail, certificates matter in more places than people expect. Mail apps check them on submission and IMAP. Between servers, opportunistic TLS often ignores them, but MTA-STS requires the MX host's certificate to be valid and match the MX name, the MTA-STS policy host needs its own valid certificate, and DANE pins them in TLSA records. BIMI files need a valid HTTPS certificate, and mark certificates are X.509 certificates too.
Under an MTA-STS policy in enforce mode, an expired certificate on an MX host stops delivery from every sender that validates the policy.
Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
All 432 terms in the glossaryThe wiki: blocklists and bounce codes