Security
Advanced security topics and best practices for web protection
55 articles in this category
MPIC: Why Domain Validation Now Fails From Places You Don't Serve
Every explainer covers what Multi-Perspective Issuance Corroboration is and the BGP hijack it was built to stop. Almost none carry the 2026 escalation: since June 15, 2026 a CA must corroborate domain control from four remote network perspectives spanning two internet registry regions, rising to five in December. The quorum has stayed at one allowed disagreement the whole time, so the tolerance is flat while the ways to spend it have more than doubled — and geo-blocking, split-horizon DNS and firewall allowlists are where it gets spent.
OV and EV Revalidation: The 398-Day Clock on Your Company Data
Everything written about the 2026 changes charts the shrinking certificate lifetime. One number went the other way and stopped: since March 15, 2026 a CA may reuse your validated company data for 398 days instead of 825, which turned OV re-verification from a once-every-two-years event into an annual one. Why EV customers noticed nothing, when the 398 days actually start counting, and why the one step nobody can automate now gates four certificate cycles in 2027 and eight in 2029.
Every Public CA Must Support Certificate Automation by March 2027
Almost everything written about 2027 says the same thing: lifetimes drop to 100 days, so you must automate. The other half of the story sits in Chrome Root Program policy — from March 15, 2027 every publicly trusted CA has to offer automated issuance and renewal for every certificate profile it sells, OV and EV included, and prove it works. What the rule actually requires, who it binds, and why a compliance failure hits your next issuance rather than your live certificate.
The clientAuth EKU Removal: Why Public TLS Certificates No Longer Authenticate Clients
Publicly trusted TLS certificates can no longer carry the client authentication EKU, so a public certificate can identify a server but never the party connecting to one. The dates that already passed, why the last dual-purpose certificates expire around December 1, 2026, how to check a certificate's extended key usage, and how to move client credentials to a private CA.
S/MIME Certificate Validation Types: Mailbox, Organization, Sponsor and Individual
Every publicly trusted S/MIME certificate is one of four types, and the difference is whose identity the CA verified alongside the mailbox. What each type proves, what the Legacy, Multipurpose and Strict generations change, the full policy OID table, and how to read the type out of a certificate you already hold.
Certificate Trust Stores: Why One Certificate Works in Chrome and Fails in Java
There is no single trust store on a machine. Chrome ships its own on every platform except iOS, Java validates against a cacerts file that only changes when you update the JDK, and Node, Python and curl each read a bundle of their own. Why the same certificate passes in one and fails in another, and how to read the lists yourself.
PCI DSS SSL/TLS Certificate Requirements: What v4.0.1 Actually Says
PCI DSS never names EV, OV or DV — a domain-validated certificate satisfies the text. What Requirements 4.2.1, 4.2.1.1 and 12.3.3 really ask of your certificates, why two of them only became mandatory in March 2025, and how 200-day lifetimes doubled the work behind them.
What Is Perfect Forward Secrecy (PFS)? How TLS Protects Past Sessions
If someone steals your server's private key tomorrow, can they read the traffic they recorded today? Forward secrecy is the difference between yes and no — how ephemeral Diffie-Hellman works, why TLS 1.3 made it mandatory, and the session-ticket setting that quietly undoes it.
How to Prepare for Shorter SSL Certificate Lifetimes (47-Day Certificates)
The 47-day era is scheduled: 100-day certificates from March 2027, 47 days from March 2029, validation reuse down to 10 days. A four-step operational playbook — inventory, automation, validation, monitoring — with a year-by-year timeline.
What Is Certificate Transparency? CT Logs and SCTs Explained
Every publicly trusted certificate is published in append-only logs before it works in a browser. How CT logs, SCTs and precertificates fit together, why Chrome wants two SCTs on short certificates and three on long ones, what Firefox 135 changed, and the hostname leak nobody warns you about.
Shor's Algorithm Explained: How It Breaks RSA and ECC
Shor's algorithm factors large integers and solves discrete logarithms in polynomial time, which breaks RSA, Diffie-Hellman, and ECC/ECDSA. How it actually works, why AES and SHA-2 survive, how many qubits it would really need, and what it means for the certificates you run today.
wp2shell WordPress Vulnerability (CVE-2026-63030): Pre-Auth RCE, Affected Versions, and How to Patch
wp2shell is a pre-authentication remote code execution chain in WordPress Core (CVE-2026-63030, CVE-2026-60137) that abuses the REST batch endpoint. Affected branches, indicators of compromise, patching to 7.0.2 / 6.9.5 / 6.8.6, cleanup steps, and when a compromise forces a TLS key rekey.