SSL & Web Security Learning Center
Expert guides and tutorials on SSL/TLS certificates, encryption, PKI, and digital security. Written by security professionals to help you protect your websites, applications, and users.
Featured Articles
Start with these essential guides on SSL and web security
175 articles found
S/MIME Certificate Key Sizes: What Changed on September 15, 2026
Ballot SMC017 raised the RSA floor for Root, Subordinate and Cross Certificates to 4096 bits — but only for CA certificates signed on or after September 15, 2026, which is not the same rule as the 'keys created after' paraphrase now circulating. Subscriber certificates are still 2048 bits and nothing you hold needs reissuing. Why the signing date is what counts, the SHA-1 sunset that landed the same day under a different ballot, the September 2027 rule that stops sub-3072-bit intermediates issuing S/MIME at all, and the gap between 3072 and 4096 that lets some existing intermediates run on untouched.
Code Signing Certificates Must Now Carry a Reserved Policy OID
From September 15, 2026, ballot CSC-32 requires every new code signing certificate to carry exactly one CA/Browser Forum reserved policy OID — 2.23.140.1.4.1 for non-EV, 2.23.140.1.3 for EV, 2.23.140.1.4.2 for timestamping. Why 'exactly one' does not mean one policy OID in total, why the EV value sits in a different arc of the tree and breaks prefix matching, how to read the extension with openssl or certutil, and why certificates you already hold need nothing done to them.
EV Domain Validation Reuse: The 398-Day Number Is Gone
Ballot SC102 passed on July 14, 2026 and deleted the hardcoded 398-day domain reuse period from the EV Guidelines, pointing section 3.2.2.14.3 at the Baseline Requirements instead. Why the number had already stopped applying in March 2026, the two reuse clocks an EV order now runs at different speeds, what happened to the WHOIS registrant re-check, and why the 10-day domain validation limit arriving in 2029 matters more than the 47-day certificate lifetime beside it.
NIS2 and Certificates: What the Directive Actually Requires of Your Encryption
Nothing in NIS2's risk-management article names TLS, a certificate type or a certificate lifetime — Article 21(2)(h) asks for policies and procedures on cryptography and stops there. Which of the four layers of rules actually binds you, why the binding technical detail in Regulation 2024/2690 only reaches digital infrastructure and trust service providers, what a cryptography policy has to contain, and the connection almost nobody makes: the Article 23(3) significance test is about impact rather than cause, so an expired certificate that takes a service down starts the same 24-hour reporting clock as an intrusion.
Android Code Signing: Why There Is No Certificate to Buy, and What Developer Verification Changes
There is no Android code signing certificate for sale, and the reason is arithmetic rather than policy: Google Play requires the signing certificate to stay valid past October 22, 2033, while the CA/Browser Forum has capped publicly trusted code signing certificates at 460 days since March 1, 2026. Why Android pins your self-signed key at first install instead of asking a CA who you are, who really holds the key once Play App Signing is switched on, why rotating a compromised key adds one rather than retiring it, and what the developer verification deadline of September 30, 2026 actually asks you to register.
Secure Boot Certificate Expiration: What Changed in June, What Happens on October 19
Two of the three 2011 Secure Boot certificates have already expired — the KEK CA on June 24 and the third-party UEFI CA on June 27 — and the Windows Production PCA follows on October 19, 2026. None of it stops a PC booting, which is exactly why it gets under-reacted to: what expiry removes is the boot layer's ability to change, so no new boot manager, no new allow-list entry and no new revocation can reach a device that never received the 2023 replacements. Why the expired key exchange key is the one that actually closed the door, why three certificates are replaced by four, and the PowerShell check that tells you which devices are stuck.
Post-Quantum Code Signing: What You Can Actually Buy in 2026
No publicly trusted CA issues a post-quantum code signing certificate, and none can until the Code Signing Baseline Requirements change — the same forum opened that door for S/MIME back in August 2025. What ML-DSA, SLH-DSA and the stateful LMS and XMSS schemes each do, why signature size rather than compute is the migration cost, which of the three cryptographic parts of a signed file a quantum computer actually breaks, and what the October 19, 2026 Windows PCA expiry really asks of software vendors.
SSL/TLS Certificates for Databases: PostgreSQL and MySQL
A database needs the same certificate a web server needs, and one question decides who signs it: does the hostname resolve in public DNS? What most setups get wrong is the mode, not the certificate — verify-ca skips the hostname check entirely, so under a public CA every certificate that CA has ever issued to anyone is accepted as your database. Why the 200-day lifetime now in force makes renewal the real design decision, how to swap a certificate on PostgreSQL, MySQL and MariaDB without a restart, and why the file on disk stops telling you what the server is actually serving.
SSL for Customer Custom Domains: Issuing Certificates for Domains You Don't Own
A SaaS platform gets a certificate for a domain it doesn't own by having the customer delegate two separate things — the traffic, and the proof of control — and the state where only one of them is done is what reaches your support queue months later. Why the CA/Browser Forum's 2026 reuse cut, not the certificate lifetime, decides your onboarding design; why a customer's apex domain restriction blocks routing but never validation; what a tenant's CAA record does to issuance that no retry will fix; and why packing unrelated customer hostnames into one SAN certificate leaks every tenant's names to every other tenant.
How to Set Up S/MIME in Thunderbird (Windows, macOS and Linux)
Thunderbird's S/MIME setup is one import and two selections, but the step that stalls most people happens before any of them: Thunderbird keeps its own certificate store inside your mail profile, in cert9.db and key4.db, and never reads the Windows certificate store or the macOS keychain — so a certificate that signs happily in Outlook on the same machine is invisible here. Why the Select dialog can stay empty after a successful import, why encryption stays greyed out until a correspondent signs a message to you first, and why deleting the expired certificate at renewal locks every message it protected.
DV vs OV SSL Certificates: What Organization Validation Actually Buys You
DV and OV certificates encrypt traffic identically — the only bytes that differ are three extra lines in the subject field. What changed in March 2026 is that OV now runs two validation clocks at different speeds: domain proof expires after 200 days and keeps shrinking toward 10 days by 2029, while organization proof was cut from 825 days to 398 and stays there. Which counterparties actually read the organization name (browsers stopped showing it in 2019), why PCI DSS has never required OV, and the single question that settles most upgrade requests.
Code Signing Certificates for Individual Developers
An individual with no limited company can buy a code signing certificate — two of the three tiers are issued to natural persons. Open Source and Individual Validation are open to you; Extended Validation is not, unless a sole proprietorship is registered, because a registered sole trader counts as a Business Entity while a private person does not. The trade-off nobody mentions until the first installer ships is the name: on the Individual Validation route your own legal name becomes the publisher users read, and SmartScreen reputation banks against it rather than transferring if you incorporate later.
Written by Security Professionals
Our articles are created by the My-SSL team with over 10 years of experience in SSL certificates, PKI, and web security. We help businesses, developers, and IT professionals understand digital security with practical, accurate, and up-to-date guides.