Skip to main content
    My-SSL LogoMy-SSL
    Free Security Education

    SSL & Web Security Learning Center

    Expert guides and tutorials on SSL/TLS certificates, encryption, PKI, and digital security. Explore the bylines, dates and sources in each guide before applying it to your environment.

    199
    Guides published
    Oct 2, 2026
    Last guide updated
    Daniel Rehak
    Contributor articles
    Primary sources
    CA/B Forum, RFCs, vendor docs

    Browse by Topic

    Code Signing
    26 articles
    SSL Basics
    16 articles
    Guides & Tutorials
    61 articles
    Security
    55 articles
    Comparisons
    12 articles
    Installation
    25 articles
    SSL Configuration
    4 articles

    199 articles found

    Installation

    How to Install an SSL Certificate on Proxmox VE

    Proxmox keeps three certificate files and only one of them is yours to write — the other two are what the cluster uses to trust itself, and their names differ by seven characters. Which file the web interface actually serves, why a shared filesystem still means running the install command once per node, the Backup Server fingerprint that quietly breaks tonight's job, and what the 200-day limit does to a three-node cluster that renews by hand.

    My-SSL TeamAug 28, 202614 min
    Code Signing

    Sharing One Code Signing Certificate Across a Team

    Since 1 June 2023 the private key is generated inside certified hardware and cannot be exported, so there is no file left to copy onto a second laptop. What a team shares now is access to one key, and only one of the four arrangements teams use lets two developers sign at the same moment. Why the obvious fix — a certificate per developer — quietly splits your Windows SmartScreen reputation, and what the 460-day limit does to that arithmetic over five years.

    My-SSL TeamAug 27, 202615 min
    Guides

    SSL Certificates for Remote Desktop: Which Role Needs What

    Windows secures RDP with a certificate it issued to itself and quietly replaces it about every six months, which is why the identity warning keeps coming back and why ticking "don't ask me again" only buys you until the next rotation. A full Remote Desktop Services deployment exposes four separate certificate roles, each checked against a different name: which two actually need a publicly trusted issuer, why an internal CA is enough for the other two, where the name mismatch really happens on the internal hop, and how to bind a certificate on a single server that has no RDS roles at all.

    My-SSL TeamAug 27, 202614 min
    Guides

    Why OV and EV Validation Fails, and What Fixes It

    A certificate authority is not weighing your paperwork on its merits: the Baseline Requirements give it four permitted ways to verify an organisation, and anything your own company produced to get the certificate is excluded by definition. Which of the three checks your order is stuck on, why an established business with a working switchboard can still fail the phone verification, the address-only exception that clears most address holds within the hour, and the letter route for companies no database lists yet.

    My-SSL TeamAug 26, 202614 min
    Guides

    S/MIME for Teams: Key Custody and Offboarding

    Deploying S/MIME across a team turns private keys into company data, and the decision that costs money is taken before the first certificate is issued. Why a lost encryption key closes a mailbox archive permanently while a lost signing key costs an afternoon, why Google Workspace and Microsoft 365 answer the custody question in opposite directions, what to do about info@ and billing@, and the offboarding step that has to happen before the laptop is wiped.

    My-SSL TeamAug 26, 202613 min
    Security

    Root Certificate Expired? What Actually Breaks

    Three separate events get called "the root expired", and only one of them turns a working certificate into a browser warning. Why a root passing its own expiry date is usually a chain-building problem with a five-minute fix, what really broke in 2020 and 2021, and the number that has quietly replaced the printed expiry date: both Mozilla and Chrome now schedule a root out of the trust stores about fifteen years after its key was generated, which for a 2010 root with a 2038 date on it lands thirteen years early.

    My-SSL TeamAug 25, 202614 min
    Security

    Does the Cyber Resilience Act Require Code Signing?

    Regulation (EU) 2024/2847 never mentions code signing, and every vendor selling you a certificate for it is describing one control out of a set. What Annex I actually asks for, why the September 2026 deadline has nothing to do with signing while the December 2027 one does, and the question the regulation never asks that decides whether you need a publicly trusted certificate or your own key. Plus the arithmetic nobody does: a five-year support period against a 460-day certificate.

    My-SSL TeamAug 25, 202615 min
    Security

    ACME Challenge Types: Which One Your Setup Can Actually Use

    Three challenges are in general use and a fourth is arriving, and the one you can pick is decided by your infrastructure rather than your preference. What http-01, dns-01, tls-alpn-01 and dns-persist-01 each demand, the redirect rules that make most HTTP-01 exception rules unnecessary, why multi-perspective validation broke setups that had worked for years, and why the domain-validation reuse window falling from 398 days to 10 by 2029 turns the challenge choice into an architectural one.

    My-SSL TeamAug 24, 202614 min
    Security

    SSL Certificate Monitoring: What to Watch, and From Where

    Monitoring a certificate means watching four different things, and most setups watch one. What your CA account, a Certificate Transparency log, the file on the host and a probe of the live endpoint each see — and what each one is blind to. Why the 200-day maximum in force since March 2026 moved the everyday failure from "nobody renewed it" to "it renewed and never reached the server", and why a fixed 30-day expiry warning stops meaning anything by 2029.

    My-SSL TeamAug 24, 202613 min
    Guides

    S/MIME Certificate Renewal: What Expiry Does to Old Mail

    An S/MIME certificate expires; the private key it names does not stop working. Why every message encrypted before the end date still decrypts as long as the key survives the renewal, why old signatures are judged by the recipient's mail client rather than by you, what the 825-day ceiling and the 30-day mailbox check mean in practice, and the export step that has to happen before anything else.

    My-SSL TeamAug 23, 202613 min
    Security

    Certificate Pinning: What to Pin, and When Not To

    A pin is a choice of height in the certificate chain, and that choice decides how often renewal becomes an outage. Why leaf pinning dies at every reissue while an SPKI pin survives if you reuse the key, what the shrinking lifetime schedule does to the arithmetic between now and 2029, how Android and Apple actually implement pinning, the backup-pin rotation order that does not break clients, and the two branches of the decision tree that end in "do not pin".

    My-SSL TeamAug 22, 202614 min
    Guides

    Code Signing Certificates for macOS: What Actually Works

    No publicly trusted code signing certificate gets a Mac app past Gatekeeper. macOS accepts one signing hierarchy for distributed software and Apple is the only issuer inside it. What the Developer ID and notarization route actually requires, the four gates Gatekeeper runs before a first launch, what your CA certificate still signs (including Windows binaries built on a Mac), and the key-storage and validity asymmetries that catch cross-platform teams shipping to both platforms.

    My-SSL TeamAug 22, 202613 min

    All guides by topic

    Every guide in the Learning Hub, grouped by subject. 199 articles covering SSL/TLS certificates, code signing, S/MIME, PKI and server configuration.

    Code Signing

    26 guides

    SSL Basics

    16 guides

    Guides

    61 guides

    Security

    55 guides

    Installation

    25 guides

    How these guides are written and reviewed

    Guides are written by Daniel Rehak and other contributors. Check each guide’s sources and date against the current issuer or platform documentation. My-SSL also sells certificates; product recommendations have a commercial relationship to this site. Send corrections with the page URL and supporting source.

    Where a rule has a future effective date, the guide states what applies today and marks the future change separately. The most recently updated guide in this library was updated on Oct 2, 2026.

    Named authors
    Primary-source references
    Publication and update dates