Security
Advanced security topics and best practices for web protection
38 articles in this category
Root Certificate Expired? What Actually Breaks
Three separate events get called "the root expired", and only one of them turns a working certificate into a browser warning. Why a root passing its own expiry date is usually a chain-building problem with a five-minute fix, what really broke in 2020 and 2021, and the number that has quietly replaced the printed expiry date: both Mozilla and Chrome now schedule a root out of the trust stores about fifteen years after its key was generated, which for a 2010 root with a 2038 date on it lands thirteen years early.
Does the Cyber Resilience Act Require Code Signing?
Regulation (EU) 2024/2847 never mentions code signing, and every vendor selling you a certificate for it is describing one control out of a set. What Annex I actually asks for, why the September 2026 deadline has nothing to do with signing while the December 2027 one does, and the question the regulation never asks that decides whether you need a publicly trusted certificate or your own key. Plus the arithmetic nobody does: a five-year support period against a 460-day certificate.
ACME Challenge Types: Which One Your Setup Can Actually Use
Three challenges are in general use and a fourth is arriving, and the one you can pick is decided by your infrastructure rather than your preference. What http-01, dns-01, tls-alpn-01 and dns-persist-01 each demand, the redirect rules that make most HTTP-01 exception rules unnecessary, why multi-perspective validation broke setups that had worked for years, and why the domain-validation reuse window falling from 398 days to 10 by 2029 turns the challenge choice into an architectural one.
SSL Certificate Monitoring: What to Watch, and From Where
Monitoring a certificate means watching four different things, and most setups watch one. What your CA account, a Certificate Transparency log, the file on the host and a probe of the live endpoint each see — and what each one is blind to. Why the 200-day maximum in force since March 2026 moved the everyday failure from "nobody renewed it" to "it renewed and never reached the server", and why a fixed 30-day expiry warning stops meaning anything by 2029.
Certificate Pinning: What to Pin, and When Not To
A pin is a choice of height in the certificate chain, and that choice decides how often renewal becomes an outage. Why leaf pinning dies at every reissue while an SPKI pin survives if you reuse the key, what the shrinking lifetime schedule does to the arithmetic between now and 2029, how Android and Apple actually implement pinning, the backup-pin rotation order that does not break clients, and the two branches of the decision tree that end in "do not pin".
Code Signing Certificate Revoked: What Breaks and What to Do Next
Revocation is the one certificate operation nobody can undo, and it lands unevenly: one date recorded by the CA splits your release history into signatures that keep validating and signatures that stop. Which side each build falls on, why the reason you give changes the blast radius, what a customer actually sees when a revoked chain is rejected, and the order to recover in. Containment first, replacement certificate last, because that is the step that takes days.
Did AI Break AES? What Claude's HAWK and 7-Round AES Results Actually Mean
In July 2026 Anthropic reported that Claude Mythos Preview halved the effective key strength of the HAWK post-quantum signature candidate and sped up the best known attack on seven-round AES by 200–800x. Neither result touches a production system. Here is what was actually found, why it matters anyway, and what a TLS or code signing operator should do about it.
MPIC: Why Domain Validation Now Fails From Places You Don't Serve
Every explainer covers what Multi-Perspective Issuance Corroboration is and the BGP hijack it was built to stop. Almost none carry the 2026 escalation: since June 15, 2026 a CA must corroborate domain control from four remote network perspectives spanning two internet registry regions, rising to five in December. The quorum has stayed at one allowed disagreement the whole time, so the tolerance is flat while the ways to spend it have more than doubled — and geo-blocking, split-horizon DNS and firewall allowlists are where it gets spent.
OV and EV Revalidation: The 398-Day Clock on Your Company Data
Everything written about the 2026 changes charts the shrinking certificate lifetime. One number went the other way and stopped: since March 15, 2026 a CA may reuse your validated company data for 398 days instead of 825, which turned OV re-verification from a once-every-two-years event into an annual one. Why EV customers noticed nothing, when the 398 days actually start counting, and why the one step nobody can automate now gates four certificate cycles in 2027 and eight in 2029.
Every Public CA Must Support Certificate Automation by March 2027
Almost everything written about 2027 says the same thing: lifetimes drop to 100 days, so you must automate. The other half of the story sits in Chrome Root Program policy — from March 15, 2027 every publicly trusted CA has to offer automated issuance and renewal for every certificate profile it sells, OV and EV included, and prove it works. What the rule actually requires, who it binds, and why a compliance failure hits your next issuance rather than your live certificate.
The clientAuth EKU Removal: Why Public TLS Certificates No Longer Authenticate Clients
Publicly trusted TLS certificates can no longer carry the client authentication EKU, so a public certificate can identify a server but never the party connecting to one. The dates that already passed, why the last dual-purpose certificates expire around December 1, 2026, how to check a certificate's extended key usage, and how to move client credentials to a private CA.
S/MIME Certificate Validation Types: Mailbox, Organization, Sponsor and Individual
Every publicly trusted S/MIME certificate is one of four types, and the difference is whose identity the CA verified alongside the mailbox. What each type proves, what the Legacy, Multipurpose and Strict generations change, the full policy OID table, and how to read the type out of a certificate you already hold.