Guides & Tutorials
Step-by-step guides for SSL certificate management and implementation
48 articles in this category
SSL Certificates for Remote Desktop: Which Role Needs What
Windows secures RDP with a certificate it issued to itself and quietly replaces it about every six months, which is why the identity warning keeps coming back and why ticking "don't ask me again" only buys you until the next rotation. A full Remote Desktop Services deployment exposes four separate certificate roles, each checked against a different name: which two actually need a publicly trusted issuer, why an internal CA is enough for the other two, where the name mismatch really happens on the internal hop, and how to bind a certificate on a single server that has no RDS roles at all.
Why OV and EV Validation Fails, and What Fixes It
A certificate authority is not weighing your paperwork on its merits: the Baseline Requirements give it four permitted ways to verify an organisation, and anything your own company produced to get the certificate is excluded by definition. Which of the three checks your order is stuck on, why an established business with a working switchboard can still fail the phone verification, the address-only exception that clears most address holds within the hour, and the letter route for companies no database lists yet.
S/MIME for Teams: Key Custody and Offboarding
Deploying S/MIME across a team turns private keys into company data, and the decision that costs money is taken before the first certificate is issued. Why a lost encryption key closes a mailbox archive permanently while a lost signing key costs an afternoon, why Google Workspace and Microsoft 365 answer the custody question in opposite directions, what to do about info@ and billing@, and the offboarding step that has to happen before the laptop is wiped.
S/MIME Certificate Renewal: What Expiry Does to Old Mail
An S/MIME certificate expires; the private key it names does not stop working. Why every message encrypted before the end date still decrypts as long as the key survives the renewal, why old signatures are judged by the recipient's mail client rather than by you, what the 825-day ceiling and the 30-day mailbox check mean in practice, and the export step that has to happen before anything else.
Code Signing Certificates for macOS: What Actually Works
No publicly trusted code signing certificate gets a Mac app past Gatekeeper. macOS accepts one signing hierarchy for distributed software and Apple is the only issuer inside it. What the Developer ID and notarization route actually requires, the four gates Gatekeeper runs before a first launch, what your CA certificate still signs (including Windows binaries built on a Mac), and the key-storage and validity asymmetries that catch cross-platform teams shipping to both platforms.
Using One SSL Certificate on Multiple Servers: Licences, Keys and Reissues
One certificate can secure any number of servers, because nothing in TLS counts installations, but three separate questions get asked as one here. Which names the certificate covers is set by the request, how many servers may run it is a commercial licence term, and how many copies of the private key exist is decided every time you install. Why the copy-the-key habit stopped scaling when lifetimes fell to 200 days in March 2026, and when a free reissue per host is the better default.
SSL Certificates for Internal Server Names: The Four Options Left
No publicly trusted CA has been allowed to certify a name like server01, anything ending in .local, or anything under the .internal domain since 1 November 2015, and the certificates that named one were revoked by October 2016. The four routes that remain, how split-horizon DNS and the ACME dns-01 challenge put a publicly trusted certificate on a host that answers nothing from outside, the pre-flight lookup that breaks most first attempts, and what certificate transparency publishes about your estate either way.
Signed EXE Flagged as a Virus: Why It Happens and How to Fix It
A code signing certificate answers one of the three checks a Windows download passes, and the malware verdict is not it. Microsoft's own developer guidance says a signature will not bypass a behavioural classifier. How to tell which of the three gates actually stopped your build, why reputation is pooled across everything one certificate signs, the prevalence rule that blocks brand-new releases on managed fleets with no detection involved, and how to file a false positive that gets read.
SafeNet Authentication Client: Setup, PINs, and Fixing Token Errors
The middleware that turns a plugged-in USB token into something SignTool, jarsigner, and browsers can actually use, and where most code signing setups now break. Which SafeNet 5110 model your CA shipped, why installing SAC and SafeNet Minidriver together produces the intermittent failures nobody can reproduce, the four checks that isolate a token-not-detected error, and why the Administrator PIN is the one secret nobody outside your team can help you recover.
SignTool Errors: What Each One Means and How to Fix It
SignTool never touches your private key. It asks a cryptographic provider to do the signing, and since publicly trusted code signing keys were pushed into hardware in June 2023, that provider layer is where the failures live. What the hex code after SignerSign() failed actually identifies, the four buckets every failure sorts into, why a timestamp error never needs a re-sign, and a reference table for the HRESULTs you will actually see.
How to Set Up S/MIME in Apple Mail (macOS and iPhone)
One certificate, two completely different installers: macOS imports the PKCS#12 into Keychain Access, while iPhone takes the same file as a configuration profile behind your device passcode. The exact steps for each, where iOS 18 moved the settings, and why a correctly installed certificate still refuses to encrypt.
How to Set Up S/MIME in Google Workspace (Gmail)
Google splits this across four help pages, so people stall at whichever gate doesn't apply to them. Which editions actually include hosted S/MIME, why Business Plus isn't one of them, the root certificate rule most internal CAs fail, and the only way to deploy past a handful of mailboxes.