Free Security Education

SSL & Web Security Learning Center

Expert guides and tutorials on SSL/TLS certificates, encryption, PKI, and digital security. Explore the bylines, dates and sources in each guide before applying it to your environment.

205

Guides published

Oct 22, 2026

Last guide updated

Daniel Rehak

Contributor articles

Primary sources

CA/B Forum, RFCs, vendor docs

Browse by Topic

205 articles found

How to Sign Git Commits with an X.509 Certificate

Git has signed commits with X.509 since version 2.19, but the certificate most developers already own is the wrong one. GitLab requires Digital Signature in Key Usage and emailProtection in any Extended Key Usage section, which is exactly where a code signing certificate fails; its key is also locked in FIPS hardware that a per-commit workflow cannot reach. The gpgsm and smimesign setup commands, the trustlist step everyone skips, why GitHub keeps showing Verified after your certificate expires, and when SSH signing is the better answer.

My-SSL TeamSep 29, 202614 min

Installation

How to Install an SSL Certificate on F5 BIG-IP

A BIG-IP does not take a bundled PEM. It keeps the certificate, the private key and the CA chain as three separate objects and only joins them inside a Client SSL profile, which is why the habit you brought from Nginx quietly serves a leaf certificate with no chain behind it. The tmsh commands for each import, the Certificate Key Chain field people leave empty, the four-rung ladder BIG-IP climbs to pick a certificate for an SNI hostname, the same-name overwrite that renews without a maintenance window, and why native ACMEv2 arriving in BIG-IP 21.1.0 matters more every March.

My-SSL TeamSep 29, 202616 min

Guides & Tutorials

MSIX Publisher Certificate Mismatch: Fix Error 0x8007000B

Diagnose MSIX signing error 0x8007000B using Event IDs 150, 151 and 152. Check the publisher, signing certificate and package hash before rebuilding.

My-SSL Security TeamSep 28, 20266 min

Guides & Tutorials

SSL Certificate Private Key Mismatch: Prove the Pair

Check an SSL certificate and private key with OpenSSL. See real matching and mismatched RSA digests, an EC example, and the Nginx chain-order trap.

SamSep 28, 20266 min

Guides & Tutorials

Java PKIX Path Building Failed: Diagnose TLS Trust Errors

Fix Java PKIX path-building errors by checking the actual runtime, active truststore and server certificate chain—without disabling certificate validation.

My-SSL Security TeamSep 28, 20267 min

Code Signing

Can You Sign a Docker Image With a Code Signing Certificate?

Notation signs OCI container images with an X.509 code signing certificate, and a publicly trusted OV or EV certificate meets its requirements — but it ships with an empty trust store, so the public trust you paid for does not travel. Docker's 8 December 2026 shutdown of Notary v1, the certificate rules in the signature specification, why the hardware key mandate rules out the local-key path, the 460-day validity collision that breaks untimestamped signatures, and when buying a public certificate for containers is actually worth it.

Daniel RehakSep 28, 202614 min

Code Signing

How to Sign RPM and DEB Packages (and Why a Code Signing Certificate Won't)

Linux packages are signed with an OpenPGP key, and as of September 2026 there is still no way to sign an RPM directly with a certificate from a public CA. The rpmsign setup and how to read its output, why dpkg ships with embedded .deb signature checking switched off, the InRelease hash chain that is the signature apt actually verifies, the signed-by keyring pattern that replaces apt-key, what RPM 6.0 changed on 22 September 2025, and the key custody decision nobody makes for you.

Daniel RehakSep 26, 202613 min

Code Signing

NuGet Trusted Signers: Fixing NU3034 After a Certificate Rotation

NU3034 is not a broken package — it is a fingerprint allow list meeting a certificate it has never seen. What changed when Microsoft moved to a new NuGet author-signing certificate on 23 September 2026, why the fix is to append the new fingerprint rather than replace the old three, how deleting the trustedSigners section turns the error green by turning the check off, why author trust has no sync command when repository trust does, and what the 460-day validity ceiling means once people pin your packages.

Daniel RehakSep 25, 202612 min

Code Signing

Why Malware Gets Signed With Valid Certificates

A code signature makes two claims — a verified identity signed this file, and the bytes have not changed — and never claims the code is safe. The four routes attackers use to obtain one, why the June 2023 hardware mandate closed only the first, what Microsoft's May 2026 takedown of a malware-signing service revealed about deliberately short-lived certificates, and how revocation dates and timestamps decide which signatures survive.

Daniel RehakSep 24, 202612 min

Code Signing

Code Signing Key Attestation: Using Your Own HSM

A CSR proves you hold a private key; it says nothing about where that key lives — and since June 2023 that is the only thing the code signing rules care about. What key attestation is, the seven verification methods in CSBR section 6.2.7.4.2 and which CAs support which, whether a YubiKey or a Luna HSM qualifies, the auditor-witnessed route for hardware that cannot attest, and why a 460-day certificate renews just outside the 13-month reuse window.

Daniel RehakSep 23, 202612 min

Code Signing

FIPS 140-2 Is Historical: What It Means for Code Signing

On 21 September 2026 every remaining FIPS 140-2 validation moved to NIST's Historical list, and a week of vendor emails made it sound like an expiry. What Historical actually means next to Active and Revoked, why the Code Signing Baseline Requirements' “FIPS 140-2 Level 2 or Common Criteria EAL 4+” sentence did not change, the one clause the CA/Browser Forum has updated to name FIPS 140-3 and the two it has not, what to ask a token vendor now, and the single case where somebody genuinely has to buy new hardware.

Daniel RehakSep 22, 202611 min

Guides

ACME Certificate Profiles: Which One to Ask For, and What Breaks

An ACME profile is a named certificate recipe the CA advertises and your client asks for by name. The three Let's Encrypt publishes today — classic at 90 days, tlsserver at 45 since May 2026, shortlived at 160 hours — what each one strips out of the certificate, why the one-hour authorization window breaks more deployments than the shorter validity does, the Certbot version floor that silently reverts renewals, and how to decide which profile you should actually be on.

Daniel RehakSep 21, 202612 min

All guides by topic

Every guide in the Learning Hub, grouped by subject. 205 articles covering SSL/TLS certificates, code signing, S/MIME, PKI and server configuration.

Code Signing

28 guides

SSL Basics

16 guides

Guides

63 guides

Security

56 guides

Comparisons

13 guides

Installation

25 guides

SSL Configuration

4 guides

How these guides are written and reviewed

Guides are written by Daniel Rehak and other contributors. Check each guide’s sources and date against the current issuer or platform documentation. My-SSL also sells certificates; product recommendations have a commercial relationship to this site. Send corrections with the page URL and supporting source.

Where a rule has a future effective date, the guide states what applies today and marks the future change separately. The most recently updated guide in this library was updated on Oct 22, 2026.

Named authors

Primary-source references

Publication and update dates