Skip to main content
    My-SSL LogoMy-SSL
    Free Security Education

    SSL & Web Security Learning Center

    Expert guides and tutorials on SSL/TLS certificates, encryption, PKI, and digital security. Explore the bylines, dates and sources in each guide before applying it to your environment.

    205
    Guides published
    Oct 22, 2026
    Last guide updated
    Daniel Rehak
    Contributor articles
    Primary sources
    CA/B Forum, RFCs, vendor docs

    Browse by Topic

    Code Signing
    28 articles
    SSL Basics
    16 articles
    Guides & Tutorials
    63 articles
    Security
    56 articles
    Comparisons
    13 articles
    Installation
    25 articles
    SSL Configuration
    4 articles

    205 articles found

    Security

    Secure Boot Certificate Expiration: What Changed in June, What Happens on October 19

    Two of the three 2011 Secure Boot certificates have already expired — the KEK CA on June 24 and the third-party UEFI CA on June 27 — and the Windows Production PCA follows on October 19, 2026. None of it stops a PC booting, which is exactly why it gets under-reacted to: what expiry removes is the boot layer's ability to change, so no new boot manager, no new allow-list entry and no new revocation can reach a device that never received the 2023 replacements. Why the expired key exchange key is the one that actually closed the door, why three certificates are replaced by four, and the PowerShell check that tells you which devices are stuck.

    Daniel RehakSep 11, 202613 min
    Security

    Post-Quantum Code Signing: What You Can Actually Buy in 2026

    No publicly trusted CA issues a post-quantum code signing certificate, and none can until the Code Signing Baseline Requirements change — the same forum opened that door for S/MIME back in August 2025. What ML-DSA, SLH-DSA and the stateful LMS and XMSS schemes each do, why signature size rather than compute is the migration cost, which of the three cryptographic parts of a signed file a quantum computer actually breaks, and what the October 19, 2026 Windows PCA expiry really asks of software vendors.

    Daniel RehakSep 9, 202615 min
    Guides

    SSL/TLS Certificates for Databases: PostgreSQL and MySQL

    A database needs the same certificate a web server needs, and one question decides who signs it: does the hostname resolve in public DNS? What most setups get wrong is the mode, not the certificate — verify-ca skips the hostname check entirely, so under a public CA every certificate that CA has ever issued to anyone is accepted as your database. Why the 200-day lifetime now in force makes renewal the real design decision, how to swap a certificate on PostgreSQL, MySQL and MariaDB without a restart, and why the file on disk stops telling you what the server is actually serving.

    My-SSL TeamSep 8, 202614 min
    Guides

    SSL for Customer Custom Domains: Issuing Certificates for Domains You Don't Own

    A SaaS platform gets a certificate for a domain it doesn't own by having the customer delegate two separate things — the traffic, and the proof of control — and the state where only one of them is done is what reaches your support queue months later. Why the CA/Browser Forum's 2026 reuse cut, not the certificate lifetime, decides your onboarding design; why a customer's apex domain restriction blocks routing but never validation; what a tenant's CAA record does to issuance that no retry will fix; and why packing unrelated customer hostnames into one SAN certificate leaks every tenant's names to every other tenant.

    My-SSL TeamSep 8, 202614 min
    Guides

    How to Set Up S/MIME in Thunderbird (Windows, macOS and Linux)

    Thunderbird's S/MIME setup is one import and two selections, but the step that stalls most people happens before any of them: Thunderbird keeps its own certificate store inside your mail profile, in cert9.db and key4.db, and never reads the Windows certificate store or the macOS keychain — so a certificate that signs happily in Outlook on the same machine is invisible here. Why the Select dialog can stay empty after a successful import, why encryption stays greyed out until a correspondent signs a message to you first, and why deleting the expired certificate at renewal locks every message it protected.

    My-SSL TeamSep 7, 202613 min
    Comparisons

    DV vs OV SSL Certificates: What Organization Validation Actually Buys You

    DV and OV certificates encrypt traffic identically — the only bytes that differ are three extra lines in the subject field. What changed in March 2026 is that OV now runs two validation clocks at different speeds: domain proof expires after 200 days and keeps shrinking toward 10 days by 2029, while organization proof was cut from 825 days to 398 and stays there. Which counterparties actually read the organization name (browsers stopped showing it in 2019), why PCI DSS has never required OV, and the single question that settles most upgrade requests.

    My-SSL TeamSep 7, 202612 min
    Code Signing

    Code Signing Certificates for Individual Developers

    An individual with no limited company can buy a code signing certificate — two of the three tiers are issued to natural persons. Open Source and Individual Validation are open to you; Extended Validation is not, unless a sole proprietorship is registered, because a registered sole trader counts as a Business Entity while a private person does not. The trade-off nobody mentions until the first installer ships is the name: on the Individual Validation route your own legal name becomes the publisher users read, and SmartScreen reputation banks against it rather than transferring if you incorporate later.

    My-SSL TeamSep 6, 202613 min
    Installation

    How to Install an SSL Certificate on Caddy

    Caddy is the one server where installing a certificate is partly an act of subtraction. The tls directive loads your files and, in the same line, removes those hostnames from certificate automation — while leaving the HTTP-to-HTTPS redirect and the port 443 listener exactly where they were. Why the intermediate has to be concatenated into the certificate file rather than configured separately, what 'no certificate available for' is telling you, and why a renewal hook that calls caddy reload without --force can succeed and change nothing.

    My-SSL TeamSep 6, 202614 min
    Installation

    How to Install an SSL Certificate on Traefik

    Traefik accepts a purchased certificate through exactly one route, and it is neither of the two places people look first. There is no Docker label that names a certificate file, and traefik.yml — the static configuration — has nowhere to put one; the file provider in dynamic configuration is the only method. Where each file goes, why the intermediate has to be concatenated into certFile, what TRAEFIK DEFAULT CERT is telling you when it appears, and the renewal pattern that survives a 47-day lifetime because it edits configuration rather than overwriting bytes.

    My-SSL TeamSep 5, 202615 min
    Installation

    How to Install an SSL Certificate on Node.js and Express

    Node does not read a certificate bundle the way a web server does. Two option names people hold a letter apart in memory do opposite jobs: cert is the chain you send to clients and must carry the intermediate, while ca is what this process trusts and, if you set it, replaces Node's entire built-in root list rather than adding to it. Why the same setup passes in Chrome and fails on a phone, how setSecureContext swaps a renewed certificate in without dropping a connection, and the port-443 fix that silently disables NODE_EXTRA_CA_CERTS.

    My-SSL TeamSep 5, 202615 min
    Installation

    How to Install an SSL Certificate on pfSense and OPNsense

    A firewall does not keep a certificate as a file. It keeps three separate objects — the issuing CA, the certificate with its private key, and a reference held by each service that presents TLS — and importing the certificate only creates the middle one. Why the chain you serve is built from CA entries rather than from the bundle you were sent, which services keep pointing at the old certificate after the web interface has moved, how to make the ACME package restart the things it renews for, and what 200 then 100 then 47 days does to a box nobody logs into between incidents.

    My-SSL TeamSep 4, 202614 min
    Guides

    How to Automate SSL Certificate Renewal on Windows and IIS

    On Linux a renewal writes a file and reloads a service. On Windows a third step sits in between, because every listener references the certificate by a SHA-1 thumbprint that changes on every issuance. Why the scheduled task runs as a different identity than the one that installed the certificate, the private key ACL that quietly disappears at renewal, the listeners outside IIS that keep serving the old certificate without logging anything, and what the 47-day schedule does to the arithmetic.

    My-SSL TeamSep 4, 202615 min

    All guides by topic

    Every guide in the Learning Hub, grouped by subject. 205 articles covering SSL/TLS certificates, code signing, S/MIME, PKI and server configuration.

    Code Signing

    28 guides

    SSL Basics

    16 guides

    Guides

    63 guides

    Security

    56 guides

    Comparisons

    13 guides

    Installation

    25 guides

    How these guides are written and reviewed

    Guides are written by Daniel Rehak and other contributors. Check each guide’s sources and date against the current issuer or platform documentation. My-SSL also sells certificates; product recommendations have a commercial relationship to this site. Send corrections with the page URL and supporting source.

    Where a rule has a future effective date, the guide states what applies today and marks the future change separately. The most recently updated guide in this library was updated on Oct 22, 2026.

    Named authors
    Primary-source references
    Publication and update dates