A name bound to a key
A certificate is a signed statement binding a domain name to a public key.
The signature comes from a certificate authority, and trust flows down a chain. Your domain's certificate is signed by an intermediate, whose certificate is signed by a root, whose certificate ships inside the operating system or the browser.
Verify a server and you are walking that chain, checking every signature, the dates, and that the name matches the host you actually dialled.
Sit with the uncomfortable part. A root store carries roughly 150 trusted roots, and any one of them can vouch for any domain on the internet. That is simultaneously the system's strength and its weakest property.
Automate your issuance, which used to be manual and expensive. Since 2015 an agent on your server can prove it controls the domain by serving a random token at a given address, and a free 90-day certificate arrives in seconds.
Read the short lifetime as deliberate. It forces automation, and automated renewal is the only kind that works. Expired certificates are still among the most common self-inflicted outages at companies of every size.
When an authority goes rogue
Take the rogue authority problem seriously, because it has happened. In 2011 attackers breached a Dutch authority and issued themselves a valid certificate for Google's domains, which was then used to intercept mail in Iran. Browsers pulled the root and the company was bankrupt within a month.
Lean on the two defences that grew out of that. Every issued certificate now goes into public append-only logs, so a rogue issuance is at least visible. And a mobile app can hardcode the key it expects, so even a valid but wrong certificate is refused.
Pin carefully if you do that last one, because a botched pin bricks your app until the next release.
Worked example
On February 3, 2020, Microsoft Teams went down for close to three hours in the middle of the working day because an authentication certificate had expired. Microsoft confirmed the cause publicly and fixed it the only way possible, by deploying a new certificate while users stared at failed login screens. Nothing was hacked and nothing was overloaded; a date field known years in advance simply passed. The same failure class hit harder in December 2018, when an expired certificate in Ericsson's packet core software knocked out mobile data for tens of millions of O2 and SoftBank subscribers across the UK and Japan for most of a day. Shops that run Let's Encrypt with certbot renewing automatically at day 60 never see this failure; the companies with dedicated PKI teams and manual renewal calendars are, oddly, the ones that do.