Security
Advanced security topics and best practices for web protection
55 articles in this category
DANE Certificate Rollover: Why TLSA Records Break Mail
A TLSA record breaks on renewal when it pins something the renewal changes, and one digit decides which. A 3 0 1 record hashes the whole certificate, so it stops matching every single time; a 3 1 1 record hashes the public key and keeps matching for as long as the key pair is reused, which is why RFC 7672 recommends it for SMTP. The trap is that most ACME clients generate a fresh private key on every renewal unless told otherwise, quietly turning the stable record back into a per-renewal outage. The 2022 USENIX measurement of SMTP DANE found more than 87% of servers rolling over incorrectly when this happened roughly once a year; under SC-081v3 it happens around eight times a year from March 2029. Which combination survives a renewal, the publish-wait-install-prune order and why the wait is set by the TTL, where MTA-STS fails in the opposite direction, and the two commands that settle it for a host you inherited.
S/MIME Certificates Lose Their Extra EKUs on July 1, 2027
Ballot SMC018 gave the S/MIME Baseline Requirements one new compliance date. From July 1, 2027, id-kp-emailProtection is the only mandatory extended key usage and id-kp-clientAuth the only optional one permitted in publicly trusted S/MIME certificates, and in the subordinate CAs that issue them. The summary doing the rounds, that the ballot bans code signing and TLS in mail certificates, is wrong: those were prohibited already. What it removes is the open-ended permission that let the document signing key purpose and vendor OIDs such as Microsoft smart card logon ride along in a Multipurpose certificate. Which setups break, what stays grandfathered into 2029, how linting and the revocation rules enforce it, and the OpenSSL command that tells you which group you are in.
RADIUS Server Certificates for EAP-TLS: Public CA or Your Own?
An EAP-TLS deployment needs two certificates and they come from different places. The RADIUS server certificate needs only serverAuth, so an ordinary publicly trusted SSL/TLS certificate works — provided the host answers to a real FQDN in a domain you own. The client certificates need clientAuth, and no public CA has issued that since 15 May 2026, so those come from a CA you run. Which way to go on the server side turns on device management, not security posture: what Windows, Android 11+ and Apple actually enforce, why the empty server-name field is the worst combination available, and what 200-day certificates falling to 47 do to a host every device depends on.
Dedicated TLS Roots: Why Your Certificate Chain Is Changing
Every public CA is moving TLS issuance onto roots reserved for TLS server authentication alone, and Chrome Root Program Policy v1.8 caps each CA owner at two self-signed roots in the Chrome Root Store from 15 September 2027, one in and one out. Certum has issued from Certum Trusted Root CA since 15 September 2025 and its Certum Trusted Network CA loses trust on 15 April 2027; DigiCert moves default issuance to its two G5 roots on 15 October 2026. Why browsers absorb all of this without help, what the cross-certificate actually does, and which validators break: Java truststores, Android before 14, pinned roots and appliance firmware.
Cloudflare Is Becoming a Certificate Authority
Cloudflare announced on 29 September 2026 that it intends to run a public CA, and the line that decides whether this matters before the 2030s is the one about GlobalSign: it is buying publicly trusted root key material rather than growing a root, because ubiquity is the one property of a root that money buys and engineering cannot accelerate. What the two tracks in the announcement actually are, why Merkle Tree Certificates exist at all once a post-quantum chain costs over 13,000 bytes per handshake, when issuance opens, and why none of it changes anything if you buy OV or EV.
SSL Handshake Failed: Find the Cause Before You Change Anything
A failed TLS handshake is not a generic certificate problem — the side that gave up sends a numbered alert that names the fault. The full alert-code table (40, 45, 48, 70, 71, 112) mapped to real causes, the four openssl commands that isolate any handshake failure, what each client's error string means, why an incomplete chain breaks curl and Java but not Chrome, Cloudflare 525 versus 526, the two causes that are new in 2026, and the quick fixes that remove the protection instead of the fault.
Certificate Problem Reports: Who Can Start Your Revocation Clock
Anyone can ask your certificate authority to revoke a certificate it issued you — subscribers, relying parties, browser root programs, or a stranger with a certificate parser. What a Certificate Problem Report is, the 24-hour investigation the CA owes both sides, the five reasons that force revocation in a day and the eleven that allow five, why the deadline cannot be extended even by agreement, and the one clause that makes code signing different.
Certificate Linting: The Check That Runs Before a Certificate Is Signed
Pre-issuance linting has been compulsory for publicly trusted TLS certificates since 15 March 2025 under ballot SC-75, and for S/MIME since 15 September 2025 — while the Code Signing Baseline Requirements still say nothing about it at all. How a CA lints a certificate that has not been signed yet, the precertificate exemption and the condition attached to it, which of zlint's seven result statuses actually block issuance, and why a lint failure is one answer a CA cannot waive.
Authorization Domain Names: Which Name Your CA Actually Validates
An Authorization Domain Name is the name a CA validates instead of the one you asked for, and ballot SC101 turned the old prose definition into a five-step process where pruning labels and following a CNAME are permitted only if the chosen validation method allows them. The per-method table in full, why HTTP and TLS-ALPN validation may never climb to a parent domain, the CNAME step that is quietly absent from the wildcard branch, and the dual-compliance window that closes on 15 November 2026.
CAA Account Binding: What accounturi and validationmethods Do
A CAA record names the CA that may issue for your domain. RFC 8657's accounturi and validationmethods parameters narrow that to one account and one validation method. The exact record syntax, why two accounts need two records rather than two parameters, the ca-tbr-7 labels that make this work with commercial CAs outside ACME, the four configurations that quietly authorise nobody, and the CA/Browser Forum date — 15 March 2027 — when honouring both stops being optional.
Authority Information Access: What the AIA Extension Must Actually Contain
The AIA extension is mandatory in a publicly trusted TLS certificate — but neither of the two things it can hold is. Section 7.1.2.7.7 makes the CA Issuers URL a SHOULD and the OCSP URL a MAY, which means a compliant certificate can carry an AIA block with no chain-building URL in it at all. Why that gap is the entire argument behind ballot SC-104, why the ballot has passed its vote without changing the document, and the revocation rule that quietly catches any certificate whose AIA extension stops carrying an OCSP pointer.
S/MIME Certificate Key Sizes: What Changed on September 15, 2026
Ballot SMC017 raised the RSA floor for Root, Subordinate and Cross Certificates to 4096 bits — but only for CA certificates signed on or after September 15, 2026, which is not the same rule as the 'keys created after' paraphrase now circulating. Subscriber certificates are still 2048 bits and nothing you hold needs reissuing. Why the signing date is what counts, the SHA-1 sunset that landed the same day under a different ballot, the September 2027 rule that stops sub-3072-bit intermediates issuing S/MIME at all, and the gap between 3072 and 4096 that lets some existing intermediates run on untouched.