Skip to main content
    My-SSL LogoMy-SSL
    Free Security Education

    SSL & Web Security Learning Center

    Expert guides and tutorials on SSL/TLS certificates, encryption, PKI, and digital security. Explore the bylines, dates and sources in each guide before applying it to your environment.

    205
    Guides published
    Oct 22, 2026
    Last guide updated
    Daniel Rehak
    Contributor articles
    Primary sources
    CA/B Forum, RFCs, vendor docs

    Browse by Topic

    Code Signing
    28 articles
    SSL Basics
    16 articles
    Guides & Tutorials
    63 articles
    Security
    56 articles
    Comparisons
    13 articles
    Installation
    25 articles
    SSL Configuration
    4 articles

    205 articles found

    Security

    SSL Handshake Failed: Find the Cause Before You Change Anything

    A failed TLS handshake is not a generic certificate problem — the side that gave up sends a numbered alert that names the fault. The full alert-code table (40, 45, 48, 70, 71, 112) mapped to real causes, the four openssl commands that isolate any handshake failure, what each client's error string means, why an incomplete chain breaks curl and Java but not Chrome, Cloudflare 525 versus 526, the two causes that are new in 2026, and the quick fixes that remove the protection instead of the fault.

    My-SSL Security TeamSep 21, 202613 min
    Security

    Certificate Problem Reports: Who Can Start Your Revocation Clock

    Anyone can ask your certificate authority to revoke a certificate it issued you — subscribers, relying parties, browser root programs, or a stranger with a certificate parser. What a Certificate Problem Report is, the 24-hour investigation the CA owes both sides, the five reasons that force revocation in a day and the eleven that allow five, why the deadline cannot be extended even by agreement, and the one clause that makes code signing different.

    Daniel RehakSep 20, 202612 min
    Security

    Certificate Linting: The Check That Runs Before a Certificate Is Signed

    Pre-issuance linting has been compulsory for publicly trusted TLS certificates since 15 March 2025 under ballot SC-75, and for S/MIME since 15 September 2025 — while the Code Signing Baseline Requirements still say nothing about it at all. How a CA lints a certificate that has not been signed yet, the precertificate exemption and the condition attached to it, which of zlint's seven result statuses actually block issuance, and why a lint failure is one answer a CA cannot waive.

    Daniel RehakSep 20, 202612 min
    Security

    Authorization Domain Names: Which Name Your CA Actually Validates

    An Authorization Domain Name is the name a CA validates instead of the one you asked for, and ballot SC101 turned the old prose definition into a five-step process where pruning labels and following a CNAME are permitted only if the chosen validation method allows them. The per-method table in full, why HTTP and TLS-ALPN validation may never climb to a parent domain, the CNAME step that is quietly absent from the wildcard branch, and the dual-compliance window that closes on 15 November 2026.

    Daniel RehakSep 19, 202612 min
    Security

    CAA Account Binding: What accounturi and validationmethods Do

    A CAA record names the CA that may issue for your domain. RFC 8657's accounturi and validationmethods parameters narrow that to one account and one validation method. The exact record syntax, why two accounts need two records rather than two parameters, the ca-tbr-7 labels that make this work with commercial CAs outside ACME, the four configurations that quietly authorise nobody, and the CA/Browser Forum date — 15 March 2027 — when honouring both stops being optional.

    Daniel RehakSep 17, 202613 min
    Guides

    ACME Renewal Information (ARI): Letting the CA Set Your Renewal Window

    ARI, standardised as RFC 9773, moves one decision from your ACME client to the certificate authority: when to renew. What the suggestedWindow actually contains, the arithmetic Let's Encrypt runs to produce it — two-thirds of the way through the lifetime, or halfway for certificates under ten days — and the window placed deliberately in the past that tells every client to reissue now. Plus the replaces field that earns a rate-limit exemption, which client honours ARI today, and the one missing byte in a serial number that makes Sectigo reject an order while Let's Encrypt accepts it.

    Daniel RehakSep 16, 202612 min
    Security

    Authority Information Access: What the AIA Extension Must Actually Contain

    The AIA extension is mandatory in a publicly trusted TLS certificate — but neither of the two things it can hold is. Section 7.1.2.7.7 makes the CA Issuers URL a SHOULD and the OCSP URL a MAY, which means a compliant certificate can carry an AIA block with no chain-building URL in it at all. Why that gap is the entire argument behind ballot SC-104, why the ballot has passed its vote without changing the document, and the revocation rule that quietly catches any certificate whose AIA extension stops carrying an OCSP pointer.

    Daniel RehakSep 16, 202612 min
    Security

    S/MIME Certificate Key Sizes: What Changed on September 15, 2026

    Ballot SMC017 raised the RSA floor for Root, Subordinate and Cross Certificates to 4096 bits — but only for CA certificates signed on or after September 15, 2026, which is not the same rule as the 'keys created after' paraphrase now circulating. Subscriber certificates are still 2048 bits and nothing you hold needs reissuing. Why the signing date is what counts, the SHA-1 sunset that landed the same day under a different ballot, the September 2027 rule that stops sub-3072-bit intermediates issuing S/MIME at all, and the gap between 3072 and 4096 that lets some existing intermediates run on untouched.

    Daniel RehakSep 16, 202611 min
    Security

    Code Signing Certificates Must Now Carry a Reserved Policy OID

    From September 15, 2026, ballot CSC-32 requires every new code signing certificate to carry exactly one CA/Browser Forum reserved policy OID — 2.23.140.1.4.1 for non-EV, 2.23.140.1.3 for EV, 2.23.140.1.4.2 for timestamping. Why 'exactly one' does not mean one policy OID in total, why the EV value sits in a different arc of the tree and breaks prefix matching, how to read the extension with openssl or certutil, and why certificates you already hold need nothing done to them.

    Daniel RehakSep 15, 202611 min
    Security

    EV Domain Validation Reuse: The 398-Day Number Is Gone

    Ballot SC102 passed on July 14, 2026 and deleted the hardcoded 398-day domain reuse period from the EV Guidelines, pointing section 3.2.2.14.3 at the Baseline Requirements instead. Why the number had already stopped applying in March 2026, the two reuse clocks an EV order now runs at different speeds, what happened to the WHOIS registrant re-check, and why the 10-day domain validation limit arriving in 2029 matters more than the 47-day certificate lifetime beside it.

    Daniel RehakSep 14, 202612 min
    Security

    NIS2 and Certificates: What the Directive Actually Requires of Your Encryption

    Nothing in NIS2's risk-management article names TLS, a certificate type or a certificate lifetime — Article 21(2)(h) asks for policies and procedures on cryptography and stops there. Which of the four layers of rules actually binds you, why the binding technical detail in Regulation 2024/2690 only reaches digital infrastructure and trust service providers, what a cryptography policy has to contain, and the connection almost nobody makes: the Article 23(3) significance test is about impact rather than cause, so an expired certificate that takes a service down starts the same 24-hour reporting clock as an intrusion.

    Daniel RehakSep 12, 202614 min
    Code Signing

    Android Code Signing: Why There Is No Certificate to Buy, and What Developer Verification Changes

    There is no Android code signing certificate for sale, and the reason is arithmetic rather than policy: Google Play requires the signing certificate to stay valid past October 22, 2033, while the CA/Browser Forum has capped publicly trusted code signing certificates at 460 days since March 1, 2026. Why Android pins your self-signed key at first install instead of asking a CA who you are, who really holds the key once Play App Signing is switched on, why rotating a compromised key adds one rather than retiring it, and what the developer verification deadline of September 30, 2026 actually asks you to register.

    Daniel RehakSep 12, 202614 min

    All guides by topic

    Every guide in the Learning Hub, grouped by subject. 205 articles covering SSL/TLS certificates, code signing, S/MIME, PKI and server configuration.

    Code Signing

    28 guides

    SSL Basics

    16 guides

    Guides

    63 guides

    Security

    56 guides

    Comparisons

    13 guides

    Installation

    25 guides

    How these guides are written and reviewed

    Guides are written by Daniel Rehak and other contributors. Check each guide’s sources and date against the current issuer or platform documentation. My-SSL also sells certificates; product recommendations have a commercial relationship to this site. Send corrections with the page URL and supporting source.

    Where a rule has a future effective date, the guide states what applies today and marks the future change separately. The most recently updated guide in this library was updated on Oct 22, 2026.

    Named authors
    Primary-source references
    Publication and update dates