Skip to main content
    My-SSL LogoMy-SSL
    Free Security Education

    SSL & Web Security Learning Center

    Expert guides and tutorials on SSL/TLS certificates, encryption, PKI, and digital security. Explore the bylines, dates and sources in each guide before applying it to your environment.

    206
    Guides published
    Oct 27, 2026
    Last guide updated
    Daniel Rehak
    Contributor articles
    Primary sources
    CA/B Forum, RFCs, vendor docs

    Browse by Topic

    Code Signing
    30 articles
    SSL Basics
    16 articles
    Guides & Tutorials
    62 articles
    Security
    56 articles
    Comparisons
    13 articles
    Installation
    25 articles
    SSL Configuration
    4 articles

    Featured Articles

    Start with these essential guides on SSL and web security

    Installation

    How to Install SSL Certificate on cPanel

    Complete step-by-step guide to install SSL certificates on cPanel. Generate CSR, upload certificates, configure HTTPS, and troubleshoot common issues.

    18 min read
    Guides

    Complete Guide to Free SSL Certificate Tools

    15 min read
    SSL Basics

    What is an SSL Certificate?

    8 min read

    206 articles found

    Code Signing

    PowerShell "Script Is Not Digitally Signed": Causes and Fixes

    PowerShell says a script is not digitally signed when RemoteSigned meets a downloaded file, when AllSigned meets any unsigned file, or when Group Policy imposes either. Three read-only commands to find the cause, when Unblock-File is the right fix, what Unrestricted and Bypass really do, and what broke a signed script in our line-ending test.

    My-SSL TeamOct 26, 20269 min
    Security

    eMudhra Intermediate CA Compromise: What It Means and What to Do

    Eight eMudhra intermediate CA keys could be recovered from the public certificates; one was the number 4. We recovered all eight in 0.1 seconds, read the revocation lists, and tested a trust bundle before and after the fix. What browsers blocked, why eMudhra customers on emSign ECC Root CA - G3 must replace certificates, and which updates developers need.

    My-SSL TeamOct 21, 20269 min
    Code Signing

    How to Sign a DLL With a Code Signing Certificate

    Sign a DLL with one SignTool command, SHA-256 and an RFC 3161 timestamp, then check it with signtool verify /pa. Why Visual Studio's "Sign the assembly" is strong naming rather than Authenticode, why strong naming must come first when you need both, and what we saw when we signed a native and a strong-named .NET DLL and then changed the strong-name bytes.

    My-SSL TeamOct 20, 20269 min
    Guides

    Certified PDF Signatures: How Certifying Differs From Signing

    A certified PDF signature is the author's one and only first signature, and it fixes which later changes stay valid: none, form fill-in and signing, or those plus comments. What each level allows, why approvers need an empty signature field before you certify, why certifying is refused once a file is signed, and what we saw when we changed certified PDFs in a pyHanko test.

    My-SSL TeamOct 18, 20268 min
    Comparisons

    Free S/MIME Certificate: Who Still Offers One, and the Catch

    Actalis's Mailbox Validated certificate is the one publicly trusted free S/MIME certificate left in October 2026: free for the first year, then €6.00 + VAT a year, with the private key generated by Actalis. What it can show, which roots it depends on, how to check the PKCS#12 file you receive, and why self-signed, CAcert and Let's Encrypt don't fill the gap.

    My-SSL TeamOct 13, 20269 min
    Code Signing

    SimplySign Desktop: Set Up Certum Code Signing in 5 Steps

    SimplySign Desktop connects your computer to a Certum code signing certificate whose key stays on a virtual card in Certum's cloud. The five setup steps from activation to a signed EXE, the systems and builds Certum supports as of October 2026, the SignTool command option by option, and the limits to plan around: 5,000 signatures a month and a new thumbprint at every reissue.

    My-SSL TeamOct 11, 20269 min
    Guides

    smime.p7s: Why Your Signed Email Arrives as an Attachment

    smime.p7s is the detached signature on an S/MIME-signed email, not a document and not an error. A real OpenSSL signing test shows what the file contains, why some mail apps list it as an attachment, why opaque signing (smime.p7m) hides real attachments, and why mail robots seem to lose them.

    My-SSL TeamOct 9, 202612 min
    Security

    DANE Certificate Rollover: Why TLSA Records Break Mail

    A TLSA record breaks on renewal when it pins something the renewal changes, and one digit decides which. A 3 0 1 record hashes the whole certificate, so it stops matching every single time; a 3 1 1 record hashes the public key and keeps matching for as long as the key pair is reused, which is why RFC 7672 recommends it for SMTP. The trap is that most ACME clients generate a fresh private key on every renewal unless told otherwise, quietly turning the stable record back into a per-renewal outage. The 2022 USENIX measurement of SMTP DANE found more than 87% of servers rolling over incorrectly when this happened roughly once a year; under SC-081v3 it happens around eight times a year from March 2029. Which combination survives a renewal, the publish-wait-install-prune order and why the wait is set by the TTL, where MTA-STS fails in the opposite direction, and the two commands that settle it for a host you inherited.

    My-SSL TeamOct 2, 202613 min
    Security

    S/MIME Certificates Lose Their Extra EKUs on July 1, 2027

    Ballot SMC018 gave the S/MIME Baseline Requirements one new compliance date. From July 1, 2027, id-kp-emailProtection is the only mandatory extended key usage and id-kp-clientAuth the only optional one permitted in publicly trusted S/MIME certificates, and in the subordinate CAs that issue them. The summary doing the rounds, that the ballot bans code signing and TLS in mail certificates, is wrong: those were prohibited already. What it removes is the open-ended permission that let the document signing key purpose and vendor OIDs such as Microsoft smart card logon ride along in a Multipurpose certificate. Which setups break, what stays grandfathered into 2029, how linting and the revocation rules enforce it, and the OpenSSL command that tells you which group you are in.

    My-SSL TeamOct 2, 202613 min
    Comparisons

    AATL vs Qualified Electronic Signature: What Your Certificate Actually Buys

    Two separate tests get run together in almost every buying guide. Adobe's Approved Trust List decides whether Acrobat shows the signature as trusted the moment the PDF opens. eIDAS decides what the signature means in law, and only a qualified electronic signature carries the handwritten-signature equivalence in Article 25(2). A standard AATL document signing certificate passes the first test and stops at advanced on the second. How the two axes differ, what the EUTL wording in Acrobat's signature properties tells you, how to confirm qualified status from the QcCompliance statement inside the certificate, and which level a counterparty can actually demand.

    My-SSL TeamOct 1, 202613 min
    Security

    RADIUS Server Certificates for EAP-TLS: Public CA or Your Own?

    An EAP-TLS deployment needs two certificates and they come from different places. The RADIUS server certificate needs only serverAuth, so an ordinary publicly trusted SSL/TLS certificate works — provided the host answers to a real FQDN in a domain you own. The client certificates need clientAuth, and no public CA has issued that since 15 May 2026, so those come from a CA you run. Which way to go on the server side turns on device management, not security posture: what Windows, Android 11+ and Apple actually enforce, why the empty server-name field is the worst combination available, and what 200-day certificates falling to 47 do to a host every device depends on.

    My-SSL TeamOct 1, 202612 min
    Security

    Dedicated TLS Roots: Why Your Certificate Chain Is Changing

    Every public CA is moving TLS issuance onto roots reserved for TLS server authentication alone, and Chrome Root Program Policy v1.8 caps each CA owner at two self-signed roots in the Chrome Root Store from 15 September 2027, one in and one out. Certum has issued from Certum Trusted Root CA since 15 September 2025 and its Certum Trusted Network CA loses trust on 15 April 2027; DigiCert moves default issuance to its two G5 roots on 15 October 2026. Why browsers absorb all of this without help, what the cross-certificate actually does, and which validators break: Java truststores, Android before 14, pinned roots and appliance firmware.

    My-SSL TeamSep 30, 202613 min

    All guides by topic

    Every guide in the Learning Hub, grouped by subject. 206 articles covering SSL/TLS certificates, code signing, S/MIME, PKI and server configuration.

    Code Signing

    30 guides

    SSL Basics

    16 guides

    Guides

    62 guides

    Security

    56 guides

    Comparisons

    13 guides

    Installation

    25 guides

    How these guides are written and reviewed

    Guides are written by Daniel Rehak and other contributors. Check each guide’s sources and date against the current issuer or platform documentation. My-SSL also sells certificates; product recommendations have a commercial relationship to this site. Send corrections with the page URL and supporting source.

    Where a rule has a future effective date, the guide states what applies today and marks the future change separately. The most recently updated guide in this library was updated on Oct 27, 2026.

    Named authors
    Primary-source references
    Publication and update dates