When setting up a web service with TLS, you must generate a pair of keys: a private key and a public key. The terminology commonly used refers to the private key as simply "key" and the public key as "certificate." The private key, referred to as the "key," is kept confidential, while the public key, contained within the "certificate," is shared with the world. When a client connects to a server, it requests the server to prove its identity. In response, the server presents its certificate to the client. To verify the server's authenticity, the client challenges the server by encrypting a secret number using the public key from the certificate and asks the server to decrypt it. Only someone who holds the corresponding private key can successfully decrypt the number. This process shows that the server holds the private key, confirming its certificate ownership. You maintain control over your identity verification by never sharing your private key. This serves as the basic idea of how TLS achieves identity verification.