Skip to main content
    My-SSL LogoMy-SSL
    Free Security Education

    SSL & Web Security Learning Center

    Expert guides and tutorials on SSL/TLS certificates, encryption, PKI, and digital security. Explore the bylines, dates and sources in each guide before applying it to your environment.

    199
    Guides published
    Oct 2, 2026
    Last guide updated
    Daniel Rehak
    Contributor articles
    Primary sources
    CA/B Forum, RFCs, vendor docs

    Browse by Topic

    Code Signing
    26 articles
    SSL Basics
    16 articles
    Guides & Tutorials
    61 articles
    Security
    55 articles
    Comparisons
    12 articles
    Installation
    25 articles
    SSL Configuration
    4 articles

    199 articles found

    Code Signing

    How to Sign RPM and DEB Packages (and Why a Code Signing Certificate Won't)

    Linux packages are signed with an OpenPGP key, and as of September 2026 there is still no way to sign an RPM directly with a certificate from a public CA. The rpmsign setup and how to read its output, why dpkg ships with embedded .deb signature checking switched off, the InRelease hash chain that is the signature apt actually verifies, the signed-by keyring pattern that replaces apt-key, what RPM 6.0 changed on 22 September 2025, and the key custody decision nobody makes for you.

    Daniel RehakSep 26, 202613 min
    Code Signing

    NuGet Trusted Signers: Fixing NU3034 After a Certificate Rotation

    NU3034 is not a broken package — it is a fingerprint allow list meeting a certificate it has never seen. What changed when Microsoft moved to a new NuGet author-signing certificate on 23 September 2026, why the fix is to append the new fingerprint rather than replace the old three, how deleting the trustedSigners section turns the error green by turning the check off, why author trust has no sync command when repository trust does, and what the 460-day validity ceiling means once people pin your packages.

    Daniel RehakSep 25, 202612 min
    Code Signing

    Why Malware Gets Signed With Valid Certificates

    A code signature makes two claims — a verified identity signed this file, and the bytes have not changed — and never claims the code is safe. The four routes attackers use to obtain one, why the June 2023 hardware mandate closed only the first, what Microsoft's May 2026 takedown of a malware-signing service revealed about deliberately short-lived certificates, and how revocation dates and timestamps decide which signatures survive.

    Daniel RehakSep 24, 202612 min
    Code Signing

    Code Signing Key Attestation: Using Your Own HSM

    A CSR proves you hold a private key; it says nothing about where that key lives — and since June 2023 that is the only thing the code signing rules care about. What key attestation is, the seven verification methods in CSBR section 6.2.7.4.2 and which CAs support which, whether a YubiKey or a Luna HSM qualifies, the auditor-witnessed route for hardware that cannot attest, and why a 460-day certificate renews just outside the 13-month reuse window.

    Daniel RehakSep 23, 202612 min
    Code Signing

    FIPS 140-2 Is Historical: What It Means for Code Signing

    On 21 September 2026 every remaining FIPS 140-2 validation moved to NIST's Historical list, and a week of vendor emails made it sound like an expiry. What Historical actually means next to Active and Revoked, why the Code Signing Baseline Requirements' “FIPS 140-2 Level 2 or Common Criteria EAL 4+” sentence did not change, the one clause the CA/Browser Forum has updated to name FIPS 140-3 and the two it has not, what to ask a token vendor now, and the single case where somebody genuinely has to buy new hardware.

    Daniel RehakSep 22, 202611 min
    Guides

    ACME Certificate Profiles: Which One to Ask For, and What Breaks

    An ACME profile is a named certificate recipe the CA advertises and your client asks for by name. The three Let's Encrypt publishes today — classic at 90 days, tlsserver at 45 since May 2026, shortlived at 160 hours — what each one strips out of the certificate, why the one-hour authorization window breaks more deployments than the shorter validity does, the Certbot version floor that silently reverts renewals, and how to decide which profile you should actually be on.

    Daniel RehakSep 21, 202612 min
    Security

    SSL Handshake Failed: Find the Cause Before You Change Anything

    A failed TLS handshake is not a generic certificate problem — the side that gave up sends a numbered alert that names the fault. The full alert-code table (40, 45, 48, 70, 71, 112) mapped to real causes, the four openssl commands that isolate any handshake failure, what each client's error string means, why an incomplete chain breaks curl and Java but not Chrome, Cloudflare 525 versus 526, the two causes that are new in 2026, and the quick fixes that remove the protection instead of the fault.

    My-SSL Security TeamSep 21, 202613 min
    Security

    Certificate Problem Reports: Who Can Start Your Revocation Clock

    Anyone can ask your certificate authority to revoke a certificate it issued you — subscribers, relying parties, browser root programs, or a stranger with a certificate parser. What a Certificate Problem Report is, the 24-hour investigation the CA owes both sides, the five reasons that force revocation in a day and the eleven that allow five, why the deadline cannot be extended even by agreement, and the one clause that makes code signing different.

    Daniel RehakSep 20, 202612 min
    Security

    Certificate Linting: The Check That Runs Before a Certificate Is Signed

    Pre-issuance linting has been compulsory for publicly trusted TLS certificates since 15 March 2025 under ballot SC-75, and for S/MIME since 15 September 2025 — while the Code Signing Baseline Requirements still say nothing about it at all. How a CA lints a certificate that has not been signed yet, the precertificate exemption and the condition attached to it, which of zlint's seven result statuses actually block issuance, and why a lint failure is one answer a CA cannot waive.

    Daniel RehakSep 20, 202612 min
    Security

    Authorization Domain Names: Which Name Your CA Actually Validates

    An Authorization Domain Name is the name a CA validates instead of the one you asked for, and ballot SC101 turned the old prose definition into a five-step process where pruning labels and following a CNAME are permitted only if the chosen validation method allows them. The per-method table in full, why HTTP and TLS-ALPN validation may never climb to a parent domain, the CNAME step that is quietly absent from the wildcard branch, and the dual-compliance window that closes on 15 November 2026.

    Daniel RehakSep 19, 202612 min
    Security

    CAA Account Binding: What accounturi and validationmethods Do

    A CAA record names the CA that may issue for your domain. RFC 8657's accounturi and validationmethods parameters narrow that to one account and one validation method. The exact record syntax, why two accounts need two records rather than two parameters, the ca-tbr-7 labels that make this work with commercial CAs outside ACME, the four configurations that quietly authorise nobody, and the CA/Browser Forum date — 15 March 2027 — when honouring both stops being optional.

    Daniel RehakSep 17, 202613 min
    Guides

    ACME Renewal Information (ARI): Letting the CA Set Your Renewal Window

    ARI, standardised as RFC 9773, moves one decision from your ACME client to the certificate authority: when to renew. What the suggestedWindow actually contains, the arithmetic Let's Encrypt runs to produce it — two-thirds of the way through the lifetime, or halfway for certificates under ten days — and the window placed deliberately in the past that tells every client to reissue now. Plus the replaces field that earns a rate-limit exemption, which client honours ARI today, and the one missing byte in a serial number that makes Sectigo reject an order while Let's Encrypt accepts it.

    Daniel RehakSep 16, 202612 min

    All guides by topic

    Every guide in the Learning Hub, grouped by subject. 199 articles covering SSL/TLS certificates, code signing, S/MIME, PKI and server configuration.

    Code Signing

    26 guides

    SSL Basics

    16 guides

    Guides

    61 guides

    Security

    55 guides

    Installation

    25 guides

    How these guides are written and reviewed

    Guides are written by Daniel Rehak and other contributors. Check each guide’s sources and date against the current issuer or platform documentation. My-SSL also sells certificates; product recommendations have a commercial relationship to this site. Send corrections with the page URL and supporting source.

    Where a rule has a future effective date, the guide states what applies today and marks the future change separately. The most recently updated guide in this library was updated on Oct 2, 2026.

    Named authors
    Primary-source references
    Publication and update dates