Guides & Tutorials
Step-by-step guides for SSL certificate management and implementation
62 articles in this category
smime.p7s: Why Your Signed Email Arrives as an Attachment
smime.p7s is the detached signature on an S/MIME-signed email, not a document and not an error. A real OpenSSL signing test shows what the file contains, why some mail apps list it as an attachment, why opaque signing (smime.p7m) hides real attachments, and why mail robots seem to lose them.
How to Sign Git Commits with an X.509 Certificate
Git has signed commits with X.509 since version 2.19, but the certificate most developers already own is the wrong one. GitLab requires Digital Signature in Key Usage and emailProtection in any Extended Key Usage section, which is exactly where a code signing certificate fails; its key is also locked in FIPS hardware that a per-commit workflow cannot reach. The gpgsm and smimesign setup commands, the trustlist step everyone skips, why GitHub keeps showing Verified after your certificate expires, and when SSH signing is the better answer.
MSIX Publisher Certificate Mismatch: Fix Error 0x8007000B
Diagnose MSIX signing error 0x8007000B using Event IDs 150, 151 and 152. Check the publisher, signing certificate and package hash before rebuilding.
SSL Certificate Private Key Mismatch: Prove the Pair
Check an SSL certificate and private key with OpenSSL. See real matching and mismatched RSA digests, an EC example, and the Nginx chain-order trap.
Java PKIX Path Building Failed: Diagnose TLS Trust Errors
Fix Java PKIX path-building errors by checking the actual runtime, active truststore and server certificate chain—without disabling certificate validation.
ACME Certificate Profiles: Which One to Ask For, and What Breaks
An ACME profile is a named certificate recipe the CA advertises and your client asks for by name. The three Let's Encrypt publishes today — classic at 90 days, tlsserver at 45 since May 2026, shortlived at 160 hours — what each one strips out of the certificate, why the one-hour authorization window breaks more deployments than the shorter validity does, the Certbot version floor that silently reverts renewals, and how to decide which profile you should actually be on.
ACME Renewal Information (ARI): Letting the CA Set Your Renewal Window
ARI, standardised as RFC 9773, moves one decision from your ACME client to the certificate authority: when to renew. What the suggestedWindow actually contains, the arithmetic Let's Encrypt runs to produce it — two-thirds of the way through the lifetime, or halfway for certificates under ten days — and the window placed deliberately in the past that tells every client to reissue now. Plus the replaces field that earns a rate-limit exemption, which client honours ARI today, and the one missing byte in a serial number that makes Sectigo reject an order while Let's Encrypt accepts it.
SSL/TLS Certificates for Databases: PostgreSQL and MySQL
A database needs the same certificate a web server needs, and one question decides who signs it: does the hostname resolve in public DNS? What most setups get wrong is the mode, not the certificate — verify-ca skips the hostname check entirely, so under a public CA every certificate that CA has ever issued to anyone is accepted as your database. Why the 200-day lifetime now in force makes renewal the real design decision, how to swap a certificate on PostgreSQL, MySQL and MariaDB without a restart, and why the file on disk stops telling you what the server is actually serving.
SSL for Customer Custom Domains: Issuing Certificates for Domains You Don't Own
A SaaS platform gets a certificate for a domain it doesn't own by having the customer delegate two separate things — the traffic, and the proof of control — and the state where only one of them is done is what reaches your support queue months later. Why the CA/Browser Forum's 2026 reuse cut, not the certificate lifetime, decides your onboarding design; why a customer's apex domain restriction blocks routing but never validation; what a tenant's CAA record does to issuance that no retry will fix; and why packing unrelated customer hostnames into one SAN certificate leaks every tenant's names to every other tenant.
How to Set Up S/MIME in Thunderbird (Windows, macOS and Linux)
Thunderbird's S/MIME setup is one import and two selections, but the step that stalls most people happens before any of them: Thunderbird keeps its own certificate store inside your mail profile, in cert9.db and key4.db, and never reads the Windows certificate store or the macOS keychain — so a certificate that signs happily in Outlook on the same machine is invisible here. Why the Select dialog can stay empty after a successful import, why encryption stays greyed out until a correspondent signs a message to you first, and why deleting the expired certificate at renewal locks every message it protected.
How to Automate SSL Certificate Renewal on Windows and IIS
On Linux a renewal writes a file and reloads a service. On Windows a third step sits in between, because every listener references the certificate by a SHA-1 thumbprint that changes on every issuance. Why the scheduled task runs as a different identity than the one that installed the certificate, the private key ACL that quietly disappears at renewal, the listeners outside IIS that keep serving the old certificate without logging anything, and what the 47-day schedule does to the arithmetic.
Why Outlook Says Your S/MIME Certificate Isn't Trusted
Outlook on the web does not read the certificate store on your PC. It validates signatures against a collection of issuer certificates held inside your Microsoft 365 tenant, and that collection starts out empty, which is why the same message is trusted on the desktop and doubted in the browser. How to publish your issuing chain with Set-SmimeConfig, the export mistake that fails silently, the address mismatch behind a sign button that does nothing, and the revocation lookup that blocks sending while reading still works.