Digital certificates used in Transport Layer Security (TLS) support non-repudiation controls and data encryption. TLS is a protocol that provides secure communication over the internet, by using encryption, authentication, and integrity mechanisms. Digital certificates are electronic documents that contain the public key and identity information of an entity, such as a server, a client, or a user. Digital certificates are issued and verified by a trusted third party, called a certificate authority (CA). Digital certificates are used in TLS to support two features: non-repudiation controls and data encryption. Non-repudiation controls are the measures that prevent an entity from denying or disputing the validity or authenticity of a communication or transaction.
Data encryption is the process of transforming data into an unreadable form, using a secret key, to protect the confidentiality of the data. Digital certificates support non-repudiation controls by using digital signatures, which are the encrypted hashes of the data, signed with the private key of the sender. Digital signatures can prove the origin, identity, and integrity of the data, and prevent the sender from denying or altering the data.
Digital certificates support data encryption by using public key encryption, which is a type of encryption that uses a pair of keys: a public key and a private key. Public key encryption can encrypt the data with the public key of the receiver, and decrypt the data with the private key of the receiver. Public key encryption can ensure that only the intended receiver can access the data, and protect the data from unauthorized interception or modification. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 3: Security Engineering, page 125; [Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 3: Security Engineering, page 187]