Most developers use TLS constantly and understand it vaguely, "it's the padlock, it means encrypted," without a clear picture of what's actually happening or, more usefully, what actually breaks and why when a cert issue takes down production. Let me lay out the real mechanics, because the vague version is exactly what makes cert errors so confusing when they show up.
TLS is doing two separate jobs, and conflating them is where the confusion starts. TLS handles both encryption, scrambling the data so nobody snooping on the connection can read it, and authentication, proving that the server you're connecting to is actually who it claims to be, not an impostor intercepting the conversation. These are genuinely separate problems, and a system can have one without the other, encrypted-but-unauthenticated connections are a real and meaningfully weaker thing than properly authenticated TLS, because encryption alone doesn't stop you from securely talking to an attacker.
A certificate is fundamentally a signed claim: this public key belongs to this identity, vouched for by someone. A TLS certificate ties a public key to an identity, typically a domain name, and it's digitally signed by a certificate authority, an entity that's vouching for that binding being genuine. When your browser sees a valid certificate for example.com, it's trusting that a certificate authority verified example.com actually controls that key, and it's trusting the certificate authority itself, which is why certificate authority trust is the actual foundation the entire system rests on, not some property of the encryption math itself.
