Guides & Tutorials
Step-by-step guides for SSL certificate management and implementation
53 articles in this category
How to Automate SSL Certificate Renewal on Windows and IIS
On Linux a renewal writes a file and reloads a service. On Windows a third step sits in between, because every listener references the certificate by a SHA-1 thumbprint that changes on every issuance. Why the scheduled task runs as a different identity than the one that installed the certificate, the private key ACL that quietly disappears at renewal, the listeners outside IIS that keep serving the old certificate without logging anything, and what the 47-day schedule does to the arithmetic.
Why Outlook Says Your S/MIME Certificate Isn't Trusted
Outlook on the web does not read the certificate store on your PC. It validates signatures against a collection of issuer certificates held inside your Microsoft 365 tenant, and that collection starts out empty, which is why the same message is trusted on the desktop and doubted in the browser. How to publish your issuing chain with Set-SmimeConfig, the export mistake that fails silently, the address mismatch behind a sign button that does nothing, and the revocation lookup that blocks sending while reading still works.
How to Switch Certificate Authorities Without Downtime
A change of CA is a reissue from zero, not a transfer: the new authority has to run its own domain validation, and for OV and EV its own organization check, because a CA may only reuse validation it performed itself. Why you overlap instead of cutting over, the CAA record that silently blocks the order, the stale intermediate bundle that breaks the clients least able to recover, and why revoking the old certificate throws away the one rollback path you have.
Why Adobe Says Your Signature Validity Is Unknown
Acrobat asks two questions of every signature and reports both in one line, which is why an unknown verdict gets mistaken for a tampering warning. Why the same PDF is trusted on one desk and doubted on the next, the two trust lists Acrobat consults offline and how stale each one gets, the reason a signature that verified last year has gone quiet without anyone touching the file, and the one fix that reaches readers you do not control.
Why Certbot Renewal Fails, and What Actually Fixes It
A renewal fails in one of three separate layers, and only the middle one prints an error: the scheduled job never ran, the certificate authority could not validate the name, or the certificate renewed and nothing reloaded the web server. Which log actually holds the reason, why a passing dry run sits happily beside an expired certificate, what the rate limits really cost you, and why the slack after a failure keeps shrinking now that expiration emails have ended.
SSL Certificates for Remote Desktop: Which Role Needs What
Windows secures RDP with a certificate it issued to itself and quietly replaces it about every six months, which is why the identity warning keeps coming back and why ticking "don't ask me again" only buys you until the next rotation. A full Remote Desktop Services deployment exposes four separate certificate roles, each checked against a different name: which two actually need a publicly trusted issuer, why an internal CA is enough for the other two, where the name mismatch really happens on the internal hop, and how to bind a certificate on a single server that has no RDS roles at all.
Why OV and EV Validation Fails, and What Fixes It
A certificate authority is not weighing your paperwork on its merits: the Baseline Requirements give it four permitted ways to verify an organisation, and anything your own company produced to get the certificate is excluded by definition. Which of the three checks your order is stuck on, why an established business with a working switchboard can still fail the phone verification, the address-only exception that clears most address holds within the hour, and the letter route for companies no database lists yet.
S/MIME for Teams: Key Custody and Offboarding
Deploying S/MIME across a team turns private keys into company data, and the decision that costs money is taken before the first certificate is issued. Why a lost encryption key closes a mailbox archive permanently while a lost signing key costs an afternoon, why Google Workspace and Microsoft 365 answer the custody question in opposite directions, what to do about info@ and billing@, and the offboarding step that has to happen before the laptop is wiped.
S/MIME Certificate Renewal: What Expiry Does to Old Mail
An S/MIME certificate expires; the private key it names does not stop working. Why every message encrypted before the end date still decrypts as long as the key survives the renewal, why old signatures are judged by the recipient's mail client rather than by you, what the 825-day ceiling and the 30-day mailbox check mean in practice, and the export step that has to happen before anything else.
Code Signing Certificates for macOS: What Actually Works
No publicly trusted code signing certificate gets a Mac app past Gatekeeper. macOS accepts one signing hierarchy for distributed software and Apple is the only issuer inside it. What the Developer ID and notarization route actually requires, the four gates Gatekeeper runs before a first launch, what your CA certificate still signs (including Windows binaries built on a Mac), and the key-storage and validity asymmetries that catch cross-platform teams shipping to both platforms.
Using One SSL Certificate on Multiple Servers: Licences, Keys and Reissues
One certificate can secure any number of servers, because nothing in TLS counts installations, but three separate questions get asked as one here. Which names the certificate covers is set by the request, how many servers may run it is a commercial licence term, and how many copies of the private key exist is decided every time you install. Why the copy-the-key habit stopped scaling when lifetimes fell to 200 days in March 2026, and when a free reissue per host is the better default.
SSL Certificates for Internal Server Names: The Four Options Left
No publicly trusted CA has been allowed to certify a name like server01, anything ending in .local, or anything under the .internal domain since 1 November 2015, and the certificates that named one were revoked by October 2016. The four routes that remain, how split-horizon DNS and the ACME dns-01 challenge put a publicly trusted certificate on a host that answers nothing from outside, the pre-flight lookup that breaks most first attempts, and what certificate transparency publishes about your estate either way.