Certificates use a technology called "digital signatures" to prove the identity of a website. The website operator has a piece of secret information called a "private key." They can use it to create a digital signature, which proves that they have possession of the private key without actually revealing the key. A site's certificate contains enough information about the private key for anyone to verify that a digital signature made with that key is valid.