Skip to main content
    My-SSL LogoMy-SSL
    Free Security Education

    SSL & Web Security Learning Center

    Expert guides and tutorials on SSL/TLS certificates, encryption, PKI, and digital security. Explore the bylines, dates and sources in each guide before applying it to your environment.

    199
    Guides published
    Oct 2, 2026
    Last guide updated
    Daniel Rehak
    Contributor articles
    Primary sources
    CA/B Forum, RFCs, vendor docs

    Browse by Topic

    Code Signing
    26 articles
    SSL Basics
    16 articles
    Guides & Tutorials
    61 articles
    Security
    55 articles
    Comparisons
    12 articles
    Installation
    25 articles
    SSL Configuration
    4 articles

    199 articles found

    Code Signing

    Code Signing Certificates for Individual Developers

    An individual with no limited company can buy a code signing certificate — two of the three tiers are issued to natural persons. Open Source and Individual Validation are open to you; Extended Validation is not, unless a sole proprietorship is registered, because a registered sole trader counts as a Business Entity while a private person does not. The trade-off nobody mentions until the first installer ships is the name: on the Individual Validation route your own legal name becomes the publisher users read, and SmartScreen reputation banks against it rather than transferring if you incorporate later.

    My-SSL TeamSep 6, 202613 min
    Installation

    How to Install an SSL Certificate on Caddy

    Caddy is the one server where installing a certificate is partly an act of subtraction. The tls directive loads your files and, in the same line, removes those hostnames from certificate automation — while leaving the HTTP-to-HTTPS redirect and the port 443 listener exactly where they were. Why the intermediate has to be concatenated into the certificate file rather than configured separately, what 'no certificate available for' is telling you, and why a renewal hook that calls caddy reload without --force can succeed and change nothing.

    My-SSL TeamSep 6, 202614 min
    Installation

    How to Install an SSL Certificate on Traefik

    Traefik accepts a purchased certificate through exactly one route, and it is neither of the two places people look first. There is no Docker label that names a certificate file, and traefik.yml — the static configuration — has nowhere to put one; the file provider in dynamic configuration is the only method. Where each file goes, why the intermediate has to be concatenated into certFile, what TRAEFIK DEFAULT CERT is telling you when it appears, and the renewal pattern that survives a 47-day lifetime because it edits configuration rather than overwriting bytes.

    My-SSL TeamSep 5, 202615 min
    Installation

    How to Install an SSL Certificate on Node.js and Express

    Node does not read a certificate bundle the way a web server does. Two option names people hold a letter apart in memory do opposite jobs: cert is the chain you send to clients and must carry the intermediate, while ca is what this process trusts and, if you set it, replaces Node's entire built-in root list rather than adding to it. Why the same setup passes in Chrome and fails on a phone, how setSecureContext swaps a renewed certificate in without dropping a connection, and the port-443 fix that silently disables NODE_EXTRA_CA_CERTS.

    My-SSL TeamSep 5, 202615 min
    Installation

    How to Install an SSL Certificate on pfSense and OPNsense

    A firewall does not keep a certificate as a file. It keeps three separate objects — the issuing CA, the certificate with its private key, and a reference held by each service that presents TLS — and importing the certificate only creates the middle one. Why the chain you serve is built from CA entries rather than from the bundle you were sent, which services keep pointing at the old certificate after the web interface has moved, how to make the ACME package restart the things it renews for, and what 200 then 100 then 47 days does to a box nobody logs into between incidents.

    My-SSL TeamSep 4, 202614 min
    Guides

    How to Automate SSL Certificate Renewal on Windows and IIS

    On Linux a renewal writes a file and reloads a service. On Windows a third step sits in between, because every listener references the certificate by a SHA-1 thumbprint that changes on every issuance. Why the scheduled task runs as a different identity than the one that installed the certificate, the private key ACL that quietly disappears at renewal, the listeners outside IIS that keep serving the old certificate without logging anything, and what the 47-day schedule does to the arithmetic.

    My-SSL TeamSep 4, 202615 min
    Guides

    Why Outlook Says Your S/MIME Certificate Isn't Trusted

    Outlook on the web does not read the certificate store on your PC. It validates signatures against a collection of issuer certificates held inside your Microsoft 365 tenant, and that collection starts out empty, which is why the same message is trusted on the desktop and doubted in the browser. How to publish your issuing chain with Set-SmimeConfig, the export mistake that fails silently, the address mismatch behind a sign button that does nothing, and the revocation lookup that blocks sending while reading still works.

    My-SSL TeamSep 4, 202613 min
    Guides

    How to Switch Certificate Authorities Without Downtime

    A change of CA is a reissue from zero, not a transfer: the new authority has to run its own domain validation, and for OV and EV its own organization check, because a CA may only reuse validation it performed itself. Why you overlap instead of cutting over, the CAA record that silently blocks the order, the stale intermediate bundle that breaks the clients least able to recover, and why revoking the old certificate throws away the one rollback path you have.

    My-SSL TeamSep 2, 202614 min
    Guides

    Why Adobe Says Your Signature Validity Is Unknown

    Acrobat asks two questions of every signature and reports both in one line, which is why an unknown verdict gets mistaken for a tampering warning. Why the same PDF is trusted on one desk and doubted on the next, the two trust lists Acrobat consults offline and how stale each one gets, the reason a signature that verified last year has gone quiet without anyone touching the file, and the one fix that reaches readers you do not control.

    My-SSL TeamSep 2, 202613 min
    Guides

    Why Certbot Renewal Fails, and What Actually Fixes It

    A renewal fails in one of three separate layers, and only the middle one prints an error: the scheduled job never ran, the certificate authority could not validate the name, or the certificate renewed and nothing reloaded the web server. Which log actually holds the reason, why a passing dry run sits happily beside an expired certificate, what the rate limits really cost you, and why the slack after a failure keeps shrinking now that expiration emails have ended.

    My-SSL TeamSep 1, 202615 min
    Code Signing

    How to Sign a Python EXE Built with PyInstaller

    PyInstaller signs nothing for you on Windows, and almost every Python signing tutorial still tells you to point SignTool at a PFX file that no CA has been allowed to issue since June 2023. What a signature on a onefile build really covers, why the runtime it unpacks into %TEMP% can never be signed, which build mode that decision should change, where the two signing steps belong in a release pipeline, and what the 460-day validity cap does to a script missing one flag.

    My-SSL TeamAug 29, 202614 min
    Installation

    How to Install an SSL Certificate on a FortiGate Firewall

    A FortiGate does not have one certificate — it has a slot for every service that speaks TLS, and each is selected in a different menu. Which slot you are actually being asked to fix, why generating the request on the box matters, the second import that everyone skips and only breaks the clients you are not watching, where the certificate goes now that FortiOS 7.6.3 has replaced SSL-VPN tunnel mode, and the one slot no public CA is allowed to sell you a certificate for.

    My-SSL TeamAug 28, 202614 min

    All guides by topic

    Every guide in the Learning Hub, grouped by subject. 199 articles covering SSL/TLS certificates, code signing, S/MIME, PKI and server configuration.

    Code Signing

    26 guides

    SSL Basics

    16 guides

    Guides

    61 guides

    Security

    55 guides

    Installation

    25 guides

    How these guides are written and reviewed

    Guides are written by Daniel Rehak and other contributors. Check each guide’s sources and date against the current issuer or platform documentation. My-SSL also sells certificates; product recommendations have a commercial relationship to this site. Send corrections with the page URL and supporting source.

    Where a rule has a future effective date, the guide states what applies today and marks the future change separately. The most recently updated guide in this library was updated on Oct 2, 2026.

    Named authors
    Primary-source references
    Publication and update dates