SSL & Web Security Learning Center
Expert guides and tutorials on SSL/TLS certificates, encryption, PKI, and digital security. Explore the bylines, dates and sources in each guide before applying it to your environment.
199 articles found
Code Signing Certificate Validity: The New 460-Day Limit
Since March 1, 2026, publicly trusted code signing certificates max out at 460 days — down from about three years — under CA/Browser Forum Ballot CSC-31. What changed, who's affected, how multi-year purchases now work as reissues, and how to plan renewals without a signing gap.
What Is a Digital Signature? How It Works with Certificates
A digital signature uses a private key to prove a file came from you and hasn't been altered, while a certificate ties that key to a verified identity. How signing and verifying work, what they guarantee, and the certificate types behind HTTPS, code signing, documents, and email.
What Is a CSR? Certificate Signing Request Explained
A CSR (Certificate Signing Request) is a signed PKCS#10 block that carries your public key and identity to a certificate authority — while the matching private key stays on your server. What's inside a CSR, how it becomes a certificate, and the mistakes that stall an order.
How to Install an S/MIME Certificate in Outlook (Windows, Mac & Web)
Get your S/MIME certificate working in every Outlook: import the .pfx into the store each version actually reads — Windows store, Outlook's own S/MIME settings, or the macOS Keychain — pick it as your signing certificate, and trade one signed email before you encrypt. Includes the five errors that stop most first setups.
What Is a Document Signing Certificate? Digital PDF Signatures Explained
A document signing certificate ties a CA-verified identity to your PDF and Office signatures. What separates it from a typed e-signature, how the cryptography works, what Adobe AATL membership changes for recipients, and how the eIDAS levels decide legal weight.
How to Sign a Windows Driver (Attestation Signing, Step by Step)
Kernel drivers only load when Microsoft signs them: what your EV certificate actually signs, the attestation submission in Partner Center step by step, why Windows Server needs WHQL instead, and what the April 2026 cross-signing cutoff broke.
How to Sign an MSI or MSIX Installer (Step by Step)
Sign MSI and MSIX installers with SignTool: why packages sign from the inside out, the one-signature-per-MSI rule that breaks dual signing, the MSIX publisher-match check behind error 0x8007000B, and how Inno Setup, NSIS, and WiX bundles each get signed.
Code Signing in CI/CD: How to Automate Signing Without Exposing Your Key
Since 2023 there's no key file to paste into a CI secret — automating signatures means connecting the pipeline to certified hardware. Compare USB tokens on self-hosted runners, SimplySign cloud sessions on a dedicated agent, and pipeline-native services, plus the design rules that keep unattended signing safe.
How to Sign a JAR with jarsigner (Step by Step)
Sign a JAR with jarsigner: find your alias with keytool, sign from a keystore file or a PKCS#11 hardware token, timestamp with -tsa, verify with -verify -certs -strict, and decode the warnings — including why modern JDKs treat SHA-1-signed JARs as unsigned.
Code Signing Timestamps: Why Your Signature Outlives Your Certificate
A timestamp is a TSA's signed proof of when you signed — it's what keeps every shipped build trusted after your certificate expires. How RFC 3161 timestamping works, the commands for SignTool, PowerShell, and jarsigner, and the cases where a timestamp can't help.
Cloud Code Signing vs USB Tokens: Where Should Your Signing Key Live?
Since June 2023 every code signing key must live on certified hardware — the question is whose. Compare USB tokens, cloud signing (SimplySign), and your own HSM on delivery time, team sharing, CI/CD fit, and what happens when things get lost.
Windows SmartScreen and Code Signing: How Publisher Reputation Works
Why SmartScreen still warns on signed apps, how file-hash and certificate reputation build, what Microsoft's 2024 EV change means, and the habits that clear the 'unrecognized app' warning fastest.
All guides by topic
Every guide in the Learning Hub, grouped by subject. 199 articles covering SSL/TLS certificates, code signing, S/MIME, PKI and server configuration.
Code Signing
26 guides- Android Code Signing: Why There Is No Certificate to Buy, and What Developer Verification Changes
- Azure Trusted Signing vs a Code Signing Certificate: Which to Use?
- Can You Sign a Docker Image With a Code Signing Certificate?
- Cloud Code Signing vs USB Tokens: Where Should Your Signing Key Live?
- Code Signing Certificate Price: What OV and EV Cost in 2026
- Code Signing Certificate Validity: The New 460-Day Limit
- Code Signing Certificates Explained: What They Are, OV vs EV, and What Actually Changed
- Code Signing Certificates for Individual Developers
- Code Signing in CI/CD: How to Automate Signing Without Exposing Your Key
- Code Signing Key Attestation: Using Your Own HSM
- Code Signing Timestamps: Why Your Signature Outlives Your Certificate
- Do I Need a Code Signing Certificate?
- EV vs OV Code Signing: Which One Do You Actually Need?
- FIPS 140-2 Is Historical: What It Means for Code Signing
- How Long Does Code Signing Validation Take?
- How to Code Sign an Electron App (Windows and macOS)
- How to Renew a Code Signing Certificate in 2026
- How to Sign a Python EXE Built with PyInstaller
- How to Sign RPM and DEB Packages (and Why a Code Signing Certificate Won't)
- How to Verify a Code Signature (Windows, Linux & Java)
- NuGet Trusted Signers: Fixing NU3034 After a Certificate Rotation
- Open Source Code Signing Certificates: Who Qualifies and What They Cost
- Sharing One Code Signing Certificate Across a Team
- The 'Unknown Publisher' Warning: Why It Appears and How to Fix It
- Why Malware Gets Signed With Valid Certificates
- Windows SmartScreen and Code Signing: How Publisher Reputation Works
SSL Basics
16 guides- Free SSL Certificates Are Now Live at My-SSL Free
- How SSL Works
- S/MIME Certificate Buying Guide: Personal vs Business
- Self-Signed Certificates: What They Are, Risks, and When to Use One
- SSL Certificate Chain Explained: Intermediate Certificates and How to Fix a Broken Chain
- SSL Certificate File Formats Explained: PEM, PFX, DER & P7B
- SSL Certificates Are Now Limited to 199 Days — Here's What That Means
- SSL Certificates in 2026: What's Changing, Common Errors, and How to Choose the Right Certificate
- SSL vs TLS vs HTTPS
- Symmetric vs Asymmetric Encryption: How TLS Uses Both
- What Is a Certificate Authority (CA)? How SSL Trust Works
- What Is a CSR? Certificate Signing Request Explained
- What Is a Digital Signature? How It Works with Certificates
- What Is a Private Key? SSL Private Keys Explained
- What is an SSL Certificate? Complete Guide for 2026
- X.509 Certificates Explained: Fields, Extensions, and Structure
Guides
61 guides- ACME Certificate Profiles: Which One to Ask For, and What Breaks
- ACME Renewal Information (ARI): Letting the CA Set Your Renewal Window
- Certbot & ACME in Production: The Ultimate Automation Guide
- Cloudflare SSL Modes Explained: Flexible, Full, and Full (Strict)
- Code Signing Certificates for macOS: What Actually Works
- Complete Guide to Free SSL Certificate Tools
- DV SSL Certificate Price in 2026: Cost, What You Get, and Safe Low-Cost Options
- EV SSL Certificate Price: What It Costs in 2026
- How Much Does an SSL Certificate Cost? 2026 Prices by Type
- How to Automate SSL Certificate Renewal on Windows and IIS
- How to Digitally Sign a PDF with a Certificate (Step by Step)
- How to Digitally Sign a Word Document with a Certificate
- How to Install an S/MIME Certificate in Outlook (Windows, Mac & Web)
- How to Redirect HTTP to HTTPS: Apache, Nginx, IIS & WordPress
- How to Renew an SSL Certificate: A Step-by-Step 2026 Guide
- How to Set Up S/MIME in Apple Mail (macOS and iPhone)
- How to Set Up S/MIME in Google Workspace (Gmail)
- How to Set Up S/MIME in Thunderbird (Windows, macOS and Linux)
- How to Sign a ClickOnce Application (Step by Step)
- How to Sign a JAR with jarsigner (Step by Step)
- How to Sign a NuGet Package (Step by Step)
- How to Sign a PowerShell Script (Step by Step)
- How to Sign a VBA Macro (Word, Excel & PowerPoint)
- How to Sign a Windows Driver (Attestation Signing, Step by Step)
- How to Sign a Windows EXE on Linux or macOS (osslsigncode)
- How to Sign an EXE with SignTool (Step by Step)
- How to Sign an MSI or MSIX Installer (Step by Step)
- How to Sign Git Commits with an X.509 Certificate
- How to Switch Certificate Authorities Without Downtime
- Java Keytool Commands Cheat Sheet: Keystore, CSR, Import and Trust
- Java PKIX Path Building Failed: Diagnose TLS Trust Errors
- MSIX Publisher Certificate Mismatch: Fix Error 0x8007000B
- Multi-Domain SSL Certificate Price: What It Costs in 2026
- Multi-Domain SSL Certificates: What They Are, SAN vs UCC, and When You Need One
- OpenSSL Commands Cheat Sheet: Keys, CSR, Inspect & Convert
- OV SSL Certificate Price: What It Costs in 2026
- S/MIME Certificate Renewal: What Expiry Does to Old Mail
- S/MIME for Teams: Key Custody and Offboarding
- SafeNet Authentication Client: Setup, PINs, and Fixing Token Errors
- Signed EXE Flagged as a Virus: Why It Happens and How to Fix It
- SignTool Errors: What Each One Means and How to Fix It
- SSL Certificate for a Mail Server: Which Name, Which Type
- SSL Certificate for an IP Address: What You Can and Cannot Get
- SSL Certificate Private Key Mismatch: Prove the Pair
- SSL Certificate Types
- SSL Certificates for Internal Server Names: The Four Options Left
- SSL Certificates for Remote Desktop: Which Role Needs What
- SSL for Customer Custom Domains: Issuing Certificates for Domains You Don't Own
- SSL/TLS Certificates for Databases: PostgreSQL and MySQL
- Using a Commercial CA With cert-manager in Kubernetes
- Using One SSL Certificate on Multiple Servers: Licences, Keys and Reissues
- What Is a Document Signing Certificate? Digital PDF Signatures Explained
- What Is an Email Certificate? A Practical Guide to S/MIME Email Security
- What Is an SSL Certificate Warranty? What It Really Covers
- Which SSL Certificate Do I Need? A Step-by-Step Guide
- Why Adobe Says Your Signature Validity Is Unknown
- Why Certbot Renewal Fails, and What Actually Fixes It
- Why Outlook Says Your S/MIME Certificate Isn't Trusted
- Why OV and EV Validation Fails, and What Fixes It
- Wildcard SSL Certificate Price: What It Costs in 2026
- Wildcard SSL Certificates: What *.domain.com Covers, DV vs OV, and When to Buy One
Security
55 guides- ACME Challenge Types: Which One Your Setup Can Actually Use
- Authority Information Access: What the AIA Extension Must Actually Contain
- Authorization Domain Names: Which Name Your CA Actually Validates
- CA/Browser Forum Domain Validation Changes in 2026
- CAA Account Binding: What accounturi and validationmethods Do
- CAA Record Guide: Certificate Authority Authorization
- Certificate Linting: The Check That Runs Before a Certificate Is Signed
- Certificate Pinning: What to Pin, and When Not To
- Certificate Problem Reports: Who Can Start Your Revocation Clock
- Certificate Revocation Explained: CRL vs OCSP in 2026
- Certificate Trust Stores: Why One Certificate Works in Chrome and Fails in Java
- Cloudflare Is Becoming a Certificate Authority
- Code Signing Certificate Revoked: What Breaks and What to Do Next
- Code Signing Certificates Must Now Carry a Reserved Policy OID
- DANE Certificate Rollover: Why TLSA Records Break Mail
- Dedicated TLS Roots: Why Your Certificate Chain Is Changing
- Did AI Break AES? What Claude's HAWK and 7-Round AES Results Actually Mean
- Does the Cyber Resilience Act Require Code Signing?
- EV Domain Validation Reuse: The 398-Day Number Is Gone
- Every Public CA Must Support Certificate Automation by March 2027
- How to Prepare for Shorter SSL Certificate Lifetimes (47-Day Certificates)
- HSTS: What It Is, How It Works, and How to Enable It
- IBM Quantum Platform SSL/TLS Configuration Guide
- Mixed Content Errors: What They Are and How to Fix Them
- MPIC: Why Domain Validation Now Fails From Places You Don't Serve
- NIS2 and Certificates: What the Directive Actually Requires of Your Encryption
- OCSP Stapling Explained: What It Is, How It Works, and How to Enable It
- OpenSSL "HollowByte" Vulnerability: What the July 2026 DoS Flaw Means for Your TLS Servers
- OV and EV Revalidation: The 398-Day Clock on Your Company Data
- PCI DSS SSL/TLS Certificate Requirements: What v4.0.1 Actually Says
- Post-Quantum Code Signing: What You Can Actually Buy in 2026
- Post-Quantum Cryptography: Preparing Your Website for Quantum-Safe TLS
- RADIUS Server Certificates for EAP-TLS: Public CA or Your Own?
- Root Certificate Expired? What Actually Breaks
- S/MIME Certificate Key Sizes: What Changed on September 15, 2026
- S/MIME Certificate Validation Types: Mailbox, Organization, Sponsor and Individual
- S/MIME Certificates Lose Their Extra EKUs on July 1, 2027
- Secure Boot Certificate Expiration: What Changed in June, What Happens on October 19
- Shor's Algorithm Explained: How It Breaks RSA and ECC
- SSL Certificate Errors: What Each One Means and How to Fix It
- SSL Certificate Monitoring: What to Watch, and From Where
- SSL Certificate Validity in 2026: The 200-Day Limit and the Road to 47 Days
- SSL Handshake Failed: Find the Cause Before You Change Anything
- The clientAuth EKU Removal: Why Public TLS Certificates No Longer Authenticate Clients
- The SSL Certificate Expiration Problem: Why Shorter Lifetimes Will Cause More Outages
- TLS 1.3 vs TLS 1.2: Key Differences, Security Improvements, and How to Enable It
- TLS Cipher Suites Explained: How to Read Them and Choose the Right Ones
- What Is Certificate Transparency? CT Logs and SCTs Explained
- What Is Mutual TLS (mTLS)? How Two-Way Certificate Authentication Works
- What Is Perfect Forward Secrecy (PFS)? How TLS Protects Past Sessions
- What is PKI?
- What Is SNI? Server Name Indication, ESNI, and Encrypted Client Hello
- What Is TLS Termination? SSL Offloading and Re-Encryption Explained
- Why Does My Website Say 'Not Secure'? Causes and Fixes
- wp2shell WordPress Vulnerability (CVE-2026-63030): Pre-Auth RCE, Affected Versions, and How to Patch
Comparisons
12 guides- AATL vs Qualified Electronic Signature: What Your Certificate Actually Buys
- Certificate Authority Companies: The Complete List of SSL CAs
- Code Signing vs SSL/TLS Certificates: What Actually Differs in 2026
- DV vs OV SSL Certificates: What Organization Validation Actually Buys You
- ECC vs RSA SSL Certificates: Which Key Algorithm Should You Choose?
- How Long Does SSL Certificate Validation Take?
- Let's Encrypt vs Paid SSL Certificates: What Actually Differs in 2026
- OV vs EV SSL in 2026: Cost & When Each Is Worth It
- S/MIME vs PGP: Which Email Encryption Should You Use?
- Sigstore vs Code Signing Certificates: What Each One Can Actually Prove
- Who Issues the Most SSL Certificates? What Certificate Transparency Data Reveals (2026)
- Wildcard vs Multi-Domain SSL: Which Certificate Do You Need?
Installation
25 guides- How to Install an SSL Certificate on a FortiGate Firewall
- How to Install an SSL Certificate on a Synology NAS (DSM 7)
- How to Install an SSL Certificate on Apache (Ubuntu, Debian & Rocky Linux)
- How to Install an SSL Certificate on Apache Tomcat (9 / 10.1 / 11)
- How to Install an SSL Certificate on AWS (ACM, ALB and CloudFront)
- How to Install an SSL Certificate on Azure (App Service, Application Gateway and Key Vault)
- How to Install an SSL Certificate on Caddy
- How to Install an SSL Certificate on Exchange Server
- How to Install an SSL Certificate on F5 BIG-IP
- How to Install an SSL Certificate on Google Cloud (Load Balancer and Certificate Manager)
- How to Install an SSL Certificate on HAProxy (SSL Termination Guide)
- How to Install an SSL Certificate on Node.js and Express
- How to Install an SSL Certificate on pfSense and OPNsense
- How to Install an SSL Certificate on Postfix and Dovecot
- How to Install an SSL Certificate on Proxmox VE
- How to Install an SSL Certificate on Traefik
- How to Install an SSL Certificate on vCenter Server (vSphere 8)
- How to Install SSL Certificate on cPanel
- How to Install SSL Certificate on DirectAdmin
- How to Install SSL Certificate on GlassFish Server
- How to Install SSL Certificate on IIS 10+ (Windows Server 2016/2019/2022)
- How to Install SSL Certificate on Microsoft IIS 5 & 6
- How to Install SSL Certificate on Nginx
- How to Install SSL Certificate on Plesk
- How to Install SSL on WordPress: The Complete 2026 Guide
How these guides are written and reviewed
Guides are written by Daniel Rehak and other contributors. Check each guide’s sources and date against the current issuer or platform documentation. My-SSL also sells certificates; product recommendations have a commercial relationship to this site. Send corrections with the page URL and supporting source.
Where a rule has a future effective date, the guide states what applies today and marks the future change separately. The most recently updated guide in this library was updated on Oct 2, 2026.