SSL & Web Security Learning Center
Expert guides and tutorials on SSL/TLS certificates, encryption, PKI, and digital security. Explore the bylines, dates and sources in each guide before applying it to your environment.
199 articles found
Wildcard SSL Certificate Price: What It Costs in 2026
DV wildcard SSL runs about $50–$225 a year and OV about $100–$420 in 2026. What actually drives the price, why EV wildcards don't exist at any price, when a wildcard beats separate certificates, and how the 199-day validity cap changes renewals (without changing the sticker).
Open Source Code Signing Certificates: Who Qualifies and What They Cost
An Open Source Code Signing certificate is the cloud-based, individual-only entry tier of code signing: cheapest, no hardware token, and reserved for non-commercial open-source software. Who qualifies, the fixed "Open Source Developer" publisher label, what it can't sign, and how it compares to Standard and EV.
wp2shell WordPress Vulnerability (CVE-2026-63030): Pre-Auth RCE, Affected Versions, and How to Patch
wp2shell is a pre-authentication remote code execution chain in WordPress Core (CVE-2026-63030, CVE-2026-60137) that abuses the REST batch endpoint. Affected branches, indicators of compromise, patching to 7.0.2 / 6.9.5 / 6.8.6, cleanup steps, and when a compromise forces a TLS key rekey.
OpenSSL "HollowByte" Vulnerability: What the July 2026 DoS Flaw Means for Your TLS Servers
HollowByte is a July 2026 OpenSSL denial-of-service flaw: an 11-byte malformed TLS ClientHello can hang a server's handshake worker and hold memory. Affected 3.x branches, how to check, how to patch on Debian/RHEL/Alpine and containers, edge mitigations, and why you do not need to reissue your certificate.
How to Sign a Windows EXE on Linux or macOS (osslsigncode)
Sign Windows EXE, MSI, and DLL files from Linux or macOS with osslsigncode: install it, connect your hardware token or SimplySign cloud key over PKCS#11, hash with SHA-256, and add an RFC 3161 timestamp. The signature is identical to signtool's — the private key just has to stay on certified hardware.
Azure Trusted Signing vs a Code Signing Certificate: Which to Use?
Azure Trusted Signing (now Artifact Signing) is a $9.99/mo managed service that signs only Windows files for eligible US/CA/EU/UK entities. A CA code signing certificate is a portable, cross-platform credential you own — including Java JARs — open to publishers worldwide. How the two models differ on cost, eligibility, and what you can sign, plus a decision path.
Code Signing Certificate Price: What OV and EV Cost in 2026
Standard (OV) code signing runs about $215–$400/year and EV about $280–$690/year across CAs in 2026, with My-SSL's Certum options at $99 and $299. What drives the price, the token and cloud costs the sticker hides, and how the 460-day cap changes multi-year plans.
How Long Does SSL Certificate Validation Take?
DV SSL validates in minutes; OV takes 1–3 business days; EV up to two weeks. What the CA verifies at each level, the documents to have ready, and why an unverifiable phone number is the delay that stalls most OV and EV orders.
How to Sign a NuGet Package (Step by Step)
Sign a NuGet package with dotnet nuget sign: use a hardware-based code signing certificate, reference it by SHA-256 fingerprint, add an RFC 3161 timestamp, then register the certificate on NuGet.org and verify. Includes the author-vs-repository signature split and the errors most first uploads hit.
How to Sign a VBA Macro (Word, Excel & PowerPoint)
Sign a VBA macro in Word, Excel, or PowerPoint: choose a code signing certificate in the VBA editor, timestamp it through the registry, and set your publisher as trusted. Plus why a correctly signed macro can still hit the red 'Microsoft has blocked macros' banner — and the fix.
EV vs OV Code Signing: Which One Do You Actually Need?
EV vs OV code signing in 2026: EV no longer skips SmartScreen, so standard OV is the right choice for most publishers. When EV is still required (kernel drivers, enterprise policy), what both now cost, and how the 460-day validity and hardware-key rules affect each.
The 'Unknown Publisher' Warning: Why It Appears and How to Fix It
The 'Unknown Publisher' warning appears when Windows can't verify who signed a program. What triggers it, how it differs from the SmartScreen 'unrecognized app' warning, why it can survive signing, and how a trusted code signing certificate replaces it with your verified name.
All guides by topic
Every guide in the Learning Hub, grouped by subject. 199 articles covering SSL/TLS certificates, code signing, S/MIME, PKI and server configuration.
Code Signing
26 guides- Android Code Signing: Why There Is No Certificate to Buy, and What Developer Verification Changes
- Azure Trusted Signing vs a Code Signing Certificate: Which to Use?
- Can You Sign a Docker Image With a Code Signing Certificate?
- Cloud Code Signing vs USB Tokens: Where Should Your Signing Key Live?
- Code Signing Certificate Price: What OV and EV Cost in 2026
- Code Signing Certificate Validity: The New 460-Day Limit
- Code Signing Certificates Explained: What They Are, OV vs EV, and What Actually Changed
- Code Signing Certificates for Individual Developers
- Code Signing in CI/CD: How to Automate Signing Without Exposing Your Key
- Code Signing Key Attestation: Using Your Own HSM
- Code Signing Timestamps: Why Your Signature Outlives Your Certificate
- Do I Need a Code Signing Certificate?
- EV vs OV Code Signing: Which One Do You Actually Need?
- FIPS 140-2 Is Historical: What It Means for Code Signing
- How Long Does Code Signing Validation Take?
- How to Code Sign an Electron App (Windows and macOS)
- How to Renew a Code Signing Certificate in 2026
- How to Sign a Python EXE Built with PyInstaller
- How to Sign RPM and DEB Packages (and Why a Code Signing Certificate Won't)
- How to Verify a Code Signature (Windows, Linux & Java)
- NuGet Trusted Signers: Fixing NU3034 After a Certificate Rotation
- Open Source Code Signing Certificates: Who Qualifies and What They Cost
- Sharing One Code Signing Certificate Across a Team
- The 'Unknown Publisher' Warning: Why It Appears and How to Fix It
- Why Malware Gets Signed With Valid Certificates
- Windows SmartScreen and Code Signing: How Publisher Reputation Works
SSL Basics
16 guides- Free SSL Certificates Are Now Live at My-SSL Free
- How SSL Works
- S/MIME Certificate Buying Guide: Personal vs Business
- Self-Signed Certificates: What They Are, Risks, and When to Use One
- SSL Certificate Chain Explained: Intermediate Certificates and How to Fix a Broken Chain
- SSL Certificate File Formats Explained: PEM, PFX, DER & P7B
- SSL Certificates Are Now Limited to 199 Days — Here's What That Means
- SSL Certificates in 2026: What's Changing, Common Errors, and How to Choose the Right Certificate
- SSL vs TLS vs HTTPS
- Symmetric vs Asymmetric Encryption: How TLS Uses Both
- What Is a Certificate Authority (CA)? How SSL Trust Works
- What Is a CSR? Certificate Signing Request Explained
- What Is a Digital Signature? How It Works with Certificates
- What Is a Private Key? SSL Private Keys Explained
- What is an SSL Certificate? Complete Guide for 2026
- X.509 Certificates Explained: Fields, Extensions, and Structure
Guides
61 guides- ACME Certificate Profiles: Which One to Ask For, and What Breaks
- ACME Renewal Information (ARI): Letting the CA Set Your Renewal Window
- Certbot & ACME in Production: The Ultimate Automation Guide
- Cloudflare SSL Modes Explained: Flexible, Full, and Full (Strict)
- Code Signing Certificates for macOS: What Actually Works
- Complete Guide to Free SSL Certificate Tools
- DV SSL Certificate Price in 2026: Cost, What You Get, and Safe Low-Cost Options
- EV SSL Certificate Price: What It Costs in 2026
- How Much Does an SSL Certificate Cost? 2026 Prices by Type
- How to Automate SSL Certificate Renewal on Windows and IIS
- How to Digitally Sign a PDF with a Certificate (Step by Step)
- How to Digitally Sign a Word Document with a Certificate
- How to Install an S/MIME Certificate in Outlook (Windows, Mac & Web)
- How to Redirect HTTP to HTTPS: Apache, Nginx, IIS & WordPress
- How to Renew an SSL Certificate: A Step-by-Step 2026 Guide
- How to Set Up S/MIME in Apple Mail (macOS and iPhone)
- How to Set Up S/MIME in Google Workspace (Gmail)
- How to Set Up S/MIME in Thunderbird (Windows, macOS and Linux)
- How to Sign a ClickOnce Application (Step by Step)
- How to Sign a JAR with jarsigner (Step by Step)
- How to Sign a NuGet Package (Step by Step)
- How to Sign a PowerShell Script (Step by Step)
- How to Sign a VBA Macro (Word, Excel & PowerPoint)
- How to Sign a Windows Driver (Attestation Signing, Step by Step)
- How to Sign a Windows EXE on Linux or macOS (osslsigncode)
- How to Sign an EXE with SignTool (Step by Step)
- How to Sign an MSI or MSIX Installer (Step by Step)
- How to Sign Git Commits with an X.509 Certificate
- How to Switch Certificate Authorities Without Downtime
- Java Keytool Commands Cheat Sheet: Keystore, CSR, Import and Trust
- Java PKIX Path Building Failed: Diagnose TLS Trust Errors
- MSIX Publisher Certificate Mismatch: Fix Error 0x8007000B
- Multi-Domain SSL Certificate Price: What It Costs in 2026
- Multi-Domain SSL Certificates: What They Are, SAN vs UCC, and When You Need One
- OpenSSL Commands Cheat Sheet: Keys, CSR, Inspect & Convert
- OV SSL Certificate Price: What It Costs in 2026
- S/MIME Certificate Renewal: What Expiry Does to Old Mail
- S/MIME for Teams: Key Custody and Offboarding
- SafeNet Authentication Client: Setup, PINs, and Fixing Token Errors
- Signed EXE Flagged as a Virus: Why It Happens and How to Fix It
- SignTool Errors: What Each One Means and How to Fix It
- SSL Certificate for a Mail Server: Which Name, Which Type
- SSL Certificate for an IP Address: What You Can and Cannot Get
- SSL Certificate Private Key Mismatch: Prove the Pair
- SSL Certificate Types
- SSL Certificates for Internal Server Names: The Four Options Left
- SSL Certificates for Remote Desktop: Which Role Needs What
- SSL for Customer Custom Domains: Issuing Certificates for Domains You Don't Own
- SSL/TLS Certificates for Databases: PostgreSQL and MySQL
- Using a Commercial CA With cert-manager in Kubernetes
- Using One SSL Certificate on Multiple Servers: Licences, Keys and Reissues
- What Is a Document Signing Certificate? Digital PDF Signatures Explained
- What Is an Email Certificate? A Practical Guide to S/MIME Email Security
- What Is an SSL Certificate Warranty? What It Really Covers
- Which SSL Certificate Do I Need? A Step-by-Step Guide
- Why Adobe Says Your Signature Validity Is Unknown
- Why Certbot Renewal Fails, and What Actually Fixes It
- Why Outlook Says Your S/MIME Certificate Isn't Trusted
- Why OV and EV Validation Fails, and What Fixes It
- Wildcard SSL Certificate Price: What It Costs in 2026
- Wildcard SSL Certificates: What *.domain.com Covers, DV vs OV, and When to Buy One
Security
55 guides- ACME Challenge Types: Which One Your Setup Can Actually Use
- Authority Information Access: What the AIA Extension Must Actually Contain
- Authorization Domain Names: Which Name Your CA Actually Validates
- CA/Browser Forum Domain Validation Changes in 2026
- CAA Account Binding: What accounturi and validationmethods Do
- CAA Record Guide: Certificate Authority Authorization
- Certificate Linting: The Check That Runs Before a Certificate Is Signed
- Certificate Pinning: What to Pin, and When Not To
- Certificate Problem Reports: Who Can Start Your Revocation Clock
- Certificate Revocation Explained: CRL vs OCSP in 2026
- Certificate Trust Stores: Why One Certificate Works in Chrome and Fails in Java
- Cloudflare Is Becoming a Certificate Authority
- Code Signing Certificate Revoked: What Breaks and What to Do Next
- Code Signing Certificates Must Now Carry a Reserved Policy OID
- DANE Certificate Rollover: Why TLSA Records Break Mail
- Dedicated TLS Roots: Why Your Certificate Chain Is Changing
- Did AI Break AES? What Claude's HAWK and 7-Round AES Results Actually Mean
- Does the Cyber Resilience Act Require Code Signing?
- EV Domain Validation Reuse: The 398-Day Number Is Gone
- Every Public CA Must Support Certificate Automation by March 2027
- How to Prepare for Shorter SSL Certificate Lifetimes (47-Day Certificates)
- HSTS: What It Is, How It Works, and How to Enable It
- IBM Quantum Platform SSL/TLS Configuration Guide
- Mixed Content Errors: What They Are and How to Fix Them
- MPIC: Why Domain Validation Now Fails From Places You Don't Serve
- NIS2 and Certificates: What the Directive Actually Requires of Your Encryption
- OCSP Stapling Explained: What It Is, How It Works, and How to Enable It
- OpenSSL "HollowByte" Vulnerability: What the July 2026 DoS Flaw Means for Your TLS Servers
- OV and EV Revalidation: The 398-Day Clock on Your Company Data
- PCI DSS SSL/TLS Certificate Requirements: What v4.0.1 Actually Says
- Post-Quantum Code Signing: What You Can Actually Buy in 2026
- Post-Quantum Cryptography: Preparing Your Website for Quantum-Safe TLS
- RADIUS Server Certificates for EAP-TLS: Public CA or Your Own?
- Root Certificate Expired? What Actually Breaks
- S/MIME Certificate Key Sizes: What Changed on September 15, 2026
- S/MIME Certificate Validation Types: Mailbox, Organization, Sponsor and Individual
- S/MIME Certificates Lose Their Extra EKUs on July 1, 2027
- Secure Boot Certificate Expiration: What Changed in June, What Happens on October 19
- Shor's Algorithm Explained: How It Breaks RSA and ECC
- SSL Certificate Errors: What Each One Means and How to Fix It
- SSL Certificate Monitoring: What to Watch, and From Where
- SSL Certificate Validity in 2026: The 200-Day Limit and the Road to 47 Days
- SSL Handshake Failed: Find the Cause Before You Change Anything
- The clientAuth EKU Removal: Why Public TLS Certificates No Longer Authenticate Clients
- The SSL Certificate Expiration Problem: Why Shorter Lifetimes Will Cause More Outages
- TLS 1.3 vs TLS 1.2: Key Differences, Security Improvements, and How to Enable It
- TLS Cipher Suites Explained: How to Read Them and Choose the Right Ones
- What Is Certificate Transparency? CT Logs and SCTs Explained
- What Is Mutual TLS (mTLS)? How Two-Way Certificate Authentication Works
- What Is Perfect Forward Secrecy (PFS)? How TLS Protects Past Sessions
- What is PKI?
- What Is SNI? Server Name Indication, ESNI, and Encrypted Client Hello
- What Is TLS Termination? SSL Offloading and Re-Encryption Explained
- Why Does My Website Say 'Not Secure'? Causes and Fixes
- wp2shell WordPress Vulnerability (CVE-2026-63030): Pre-Auth RCE, Affected Versions, and How to Patch
Comparisons
12 guides- AATL vs Qualified Electronic Signature: What Your Certificate Actually Buys
- Certificate Authority Companies: The Complete List of SSL CAs
- Code Signing vs SSL/TLS Certificates: What Actually Differs in 2026
- DV vs OV SSL Certificates: What Organization Validation Actually Buys You
- ECC vs RSA SSL Certificates: Which Key Algorithm Should You Choose?
- How Long Does SSL Certificate Validation Take?
- Let's Encrypt vs Paid SSL Certificates: What Actually Differs in 2026
- OV vs EV SSL in 2026: Cost & When Each Is Worth It
- S/MIME vs PGP: Which Email Encryption Should You Use?
- Sigstore vs Code Signing Certificates: What Each One Can Actually Prove
- Who Issues the Most SSL Certificates? What Certificate Transparency Data Reveals (2026)
- Wildcard vs Multi-Domain SSL: Which Certificate Do You Need?
Installation
25 guides- How to Install an SSL Certificate on a FortiGate Firewall
- How to Install an SSL Certificate on a Synology NAS (DSM 7)
- How to Install an SSL Certificate on Apache (Ubuntu, Debian & Rocky Linux)
- How to Install an SSL Certificate on Apache Tomcat (9 / 10.1 / 11)
- How to Install an SSL Certificate on AWS (ACM, ALB and CloudFront)
- How to Install an SSL Certificate on Azure (App Service, Application Gateway and Key Vault)
- How to Install an SSL Certificate on Caddy
- How to Install an SSL Certificate on Exchange Server
- How to Install an SSL Certificate on F5 BIG-IP
- How to Install an SSL Certificate on Google Cloud (Load Balancer and Certificate Manager)
- How to Install an SSL Certificate on HAProxy (SSL Termination Guide)
- How to Install an SSL Certificate on Node.js and Express
- How to Install an SSL Certificate on pfSense and OPNsense
- How to Install an SSL Certificate on Postfix and Dovecot
- How to Install an SSL Certificate on Proxmox VE
- How to Install an SSL Certificate on Traefik
- How to Install an SSL Certificate on vCenter Server (vSphere 8)
- How to Install SSL Certificate on cPanel
- How to Install SSL Certificate on DirectAdmin
- How to Install SSL Certificate on GlassFish Server
- How to Install SSL Certificate on IIS 10+ (Windows Server 2016/2019/2022)
- How to Install SSL Certificate on Microsoft IIS 5 & 6
- How to Install SSL Certificate on Nginx
- How to Install SSL Certificate on Plesk
- How to Install SSL on WordPress: The Complete 2026 Guide
How these guides are written and reviewed
Guides are written by Daniel Rehak and other contributors. Check each guide’s sources and date against the current issuer or platform documentation. My-SSL also sells certificates; product recommendations have a commercial relationship to this site. Send corrections with the page URL and supporting source.
Where a rule has a future effective date, the guide states what applies today and marks the future change separately. The most recently updated guide in this library was updated on Oct 2, 2026.