Skip to main content
    My-SSL LogoMy-SSL
    Free Security Education

    SSL & Web Security Learning Center

    Expert guides and tutorials on SSL/TLS certificates, encryption, PKI, and digital security. Explore the bylines, dates and sources in each guide before applying it to your environment.

    199
    Guides published
    Oct 2, 2026
    Last guide updated
    Daniel Rehak
    Contributor articles
    Primary sources
    CA/B Forum, RFCs, vendor docs

    Browse by Topic

    Code Signing
    26 articles
    SSL Basics
    16 articles
    Guides & Tutorials
    61 articles
    Security
    55 articles
    Comparisons
    12 articles
    Installation
    25 articles
    SSL Configuration
    4 articles

    199 articles found

    Security

    Authority Information Access: What the AIA Extension Must Actually Contain

    The AIA extension is mandatory in a publicly trusted TLS certificate — but neither of the two things it can hold is. Section 7.1.2.7.7 makes the CA Issuers URL a SHOULD and the OCSP URL a MAY, which means a compliant certificate can carry an AIA block with no chain-building URL in it at all. Why that gap is the entire argument behind ballot SC-104, why the ballot has passed its vote without changing the document, and the revocation rule that quietly catches any certificate whose AIA extension stops carrying an OCSP pointer.

    Daniel RehakSep 16, 202612 min
    Security

    S/MIME Certificate Key Sizes: What Changed on September 15, 2026

    Ballot SMC017 raised the RSA floor for Root, Subordinate and Cross Certificates to 4096 bits — but only for CA certificates signed on or after September 15, 2026, which is not the same rule as the 'keys created after' paraphrase now circulating. Subscriber certificates are still 2048 bits and nothing you hold needs reissuing. Why the signing date is what counts, the SHA-1 sunset that landed the same day under a different ballot, the September 2027 rule that stops sub-3072-bit intermediates issuing S/MIME at all, and the gap between 3072 and 4096 that lets some existing intermediates run on untouched.

    Daniel RehakSep 16, 202611 min
    Security

    Code Signing Certificates Must Now Carry a Reserved Policy OID

    From September 15, 2026, ballot CSC-32 requires every new code signing certificate to carry exactly one CA/Browser Forum reserved policy OID — 2.23.140.1.4.1 for non-EV, 2.23.140.1.3 for EV, 2.23.140.1.4.2 for timestamping. Why 'exactly one' does not mean one policy OID in total, why the EV value sits in a different arc of the tree and breaks prefix matching, how to read the extension with openssl or certutil, and why certificates you already hold need nothing done to them.

    Daniel RehakSep 15, 202611 min
    Security

    EV Domain Validation Reuse: The 398-Day Number Is Gone

    Ballot SC102 passed on July 14, 2026 and deleted the hardcoded 398-day domain reuse period from the EV Guidelines, pointing section 3.2.2.14.3 at the Baseline Requirements instead. Why the number had already stopped applying in March 2026, the two reuse clocks an EV order now runs at different speeds, what happened to the WHOIS registrant re-check, and why the 10-day domain validation limit arriving in 2029 matters more than the 47-day certificate lifetime beside it.

    Daniel RehakSep 14, 202612 min
    Security

    NIS2 and Certificates: What the Directive Actually Requires of Your Encryption

    Nothing in NIS2's risk-management article names TLS, a certificate type or a certificate lifetime — Article 21(2)(h) asks for policies and procedures on cryptography and stops there. Which of the four layers of rules actually binds you, why the binding technical detail in Regulation 2024/2690 only reaches digital infrastructure and trust service providers, what a cryptography policy has to contain, and the connection almost nobody makes: the Article 23(3) significance test is about impact rather than cause, so an expired certificate that takes a service down starts the same 24-hour reporting clock as an intrusion.

    Daniel RehakSep 12, 202614 min
    Code Signing

    Android Code Signing: Why There Is No Certificate to Buy, and What Developer Verification Changes

    There is no Android code signing certificate for sale, and the reason is arithmetic rather than policy: Google Play requires the signing certificate to stay valid past October 22, 2033, while the CA/Browser Forum has capped publicly trusted code signing certificates at 460 days since March 1, 2026. Why Android pins your self-signed key at first install instead of asking a CA who you are, who really holds the key once Play App Signing is switched on, why rotating a compromised key adds one rather than retiring it, and what the developer verification deadline of September 30, 2026 actually asks you to register.

    Daniel RehakSep 12, 202614 min
    Security

    Secure Boot Certificate Expiration: What Changed in June, What Happens on October 19

    Two of the three 2011 Secure Boot certificates have already expired — the KEK CA on June 24 and the third-party UEFI CA on June 27 — and the Windows Production PCA follows on October 19, 2026. None of it stops a PC booting, which is exactly why it gets under-reacted to: what expiry removes is the boot layer's ability to change, so no new boot manager, no new allow-list entry and no new revocation can reach a device that never received the 2023 replacements. Why the expired key exchange key is the one that actually closed the door, why three certificates are replaced by four, and the PowerShell check that tells you which devices are stuck.

    Daniel RehakSep 11, 202613 min
    Security

    Post-Quantum Code Signing: What You Can Actually Buy in 2026

    No publicly trusted CA issues a post-quantum code signing certificate, and none can until the Code Signing Baseline Requirements change — the same forum opened that door for S/MIME back in August 2025. What ML-DSA, SLH-DSA and the stateful LMS and XMSS schemes each do, why signature size rather than compute is the migration cost, which of the three cryptographic parts of a signed file a quantum computer actually breaks, and what the October 19, 2026 Windows PCA expiry really asks of software vendors.

    Daniel RehakSep 9, 202615 min
    Guides

    SSL/TLS Certificates for Databases: PostgreSQL and MySQL

    A database needs the same certificate a web server needs, and one question decides who signs it: does the hostname resolve in public DNS? What most setups get wrong is the mode, not the certificate — verify-ca skips the hostname check entirely, so under a public CA every certificate that CA has ever issued to anyone is accepted as your database. Why the 200-day lifetime now in force makes renewal the real design decision, how to swap a certificate on PostgreSQL, MySQL and MariaDB without a restart, and why the file on disk stops telling you what the server is actually serving.

    My-SSL TeamSep 8, 202614 min
    Guides

    SSL for Customer Custom Domains: Issuing Certificates for Domains You Don't Own

    A SaaS platform gets a certificate for a domain it doesn't own by having the customer delegate two separate things — the traffic, and the proof of control — and the state where only one of them is done is what reaches your support queue months later. Why the CA/Browser Forum's 2026 reuse cut, not the certificate lifetime, decides your onboarding design; why a customer's apex domain restriction blocks routing but never validation; what a tenant's CAA record does to issuance that no retry will fix; and why packing unrelated customer hostnames into one SAN certificate leaks every tenant's names to every other tenant.

    My-SSL TeamSep 8, 202614 min
    Guides

    How to Set Up S/MIME in Thunderbird (Windows, macOS and Linux)

    Thunderbird's S/MIME setup is one import and two selections, but the step that stalls most people happens before any of them: Thunderbird keeps its own certificate store inside your mail profile, in cert9.db and key4.db, and never reads the Windows certificate store or the macOS keychain — so a certificate that signs happily in Outlook on the same machine is invisible here. Why the Select dialog can stay empty after a successful import, why encryption stays greyed out until a correspondent signs a message to you first, and why deleting the expired certificate at renewal locks every message it protected.

    My-SSL TeamSep 7, 202613 min
    Comparisons

    DV vs OV SSL Certificates: What Organization Validation Actually Buys You

    DV and OV certificates encrypt traffic identically — the only bytes that differ are three extra lines in the subject field. What changed in March 2026 is that OV now runs two validation clocks at different speeds: domain proof expires after 200 days and keeps shrinking toward 10 days by 2029, while organization proof was cut from 825 days to 398 and stays there. Which counterparties actually read the organization name (browsers stopped showing it in 2019), why PCI DSS has never required OV, and the single question that settles most upgrade requests.

    My-SSL TeamSep 7, 202612 min

    All guides by topic

    Every guide in the Learning Hub, grouped by subject. 199 articles covering SSL/TLS certificates, code signing, S/MIME, PKI and server configuration.

    Code Signing

    26 guides

    SSL Basics

    16 guides

    Guides

    61 guides

    Security

    55 guides

    Installation

    25 guides

    How these guides are written and reviewed

    Guides are written by Daniel Rehak and other contributors. Check each guide’s sources and date against the current issuer or platform documentation. My-SSL also sells certificates; product recommendations have a commercial relationship to this site. Send corrections with the page URL and supporting source.

    Where a rule has a future effective date, the guide states what applies today and marks the future change separately. The most recently updated guide in this library was updated on Oct 2, 2026.

    Named authors
    Primary-source references
    Publication and update dates