Skip to main content
    My-SSL LogoMy-SSL
    Free Security Education

    SSL & Web Security Learning Center

    Expert guides and tutorials on SSL/TLS certificates, encryption, PKI, and digital security. Explore the bylines, dates and sources in each guide before applying it to your environment.

    205
    Guides published
    Oct 22, 2026
    Last guide updated
    Daniel Rehak
    Contributor articles
    Primary sources
    CA/B Forum, RFCs, vendor docs

    Browse by Topic

    Code Signing
    28 articles
    SSL Basics
    16 articles
    Guides & Tutorials
    63 articles
    Security
    56 articles
    Comparisons
    13 articles
    Installation
    25 articles
    SSL Configuration
    4 articles

    205 articles found

    Guides

    Why Outlook Says Your S/MIME Certificate Isn't Trusted

    Outlook on the web does not read the certificate store on your PC. It validates signatures against a collection of issuer certificates held inside your Microsoft 365 tenant, and that collection starts out empty, which is why the same message is trusted on the desktop and doubted in the browser. How to publish your issuing chain with Set-SmimeConfig, the export mistake that fails silently, the address mismatch behind a sign button that does nothing, and the revocation lookup that blocks sending while reading still works.

    My-SSL TeamSep 4, 202613 min
    Guides

    How to Switch Certificate Authorities Without Downtime

    A change of CA is a reissue from zero, not a transfer: the new authority has to run its own domain validation, and for OV and EV its own organization check, because a CA may only reuse validation it performed itself. Why you overlap instead of cutting over, the CAA record that silently blocks the order, the stale intermediate bundle that breaks the clients least able to recover, and why revoking the old certificate throws away the one rollback path you have.

    My-SSL TeamSep 2, 202614 min
    Guides

    Why Adobe Says Your Signature Validity Is Unknown

    Acrobat asks two questions of every signature and reports both in one line, which is why an unknown verdict gets mistaken for a tampering warning. Why the same PDF is trusted on one desk and doubted on the next, the two trust lists Acrobat consults offline and how stale each one gets, the reason a signature that verified last year has gone quiet without anyone touching the file, and the one fix that reaches readers you do not control.

    My-SSL TeamSep 2, 202613 min
    Guides

    Why Certbot Renewal Fails, and What Actually Fixes It

    A renewal fails in one of three separate layers, and only the middle one prints an error: the scheduled job never ran, the certificate authority could not validate the name, or the certificate renewed and nothing reloaded the web server. Which log actually holds the reason, why a passing dry run sits happily beside an expired certificate, what the rate limits really cost you, and why the slack after a failure keeps shrinking now that expiration emails have ended.

    My-SSL TeamSep 1, 202615 min
    Code Signing

    How to Sign a Python EXE Built with PyInstaller

    PyInstaller signs nothing for you on Windows, and almost every Python signing tutorial still tells you to point SignTool at a PFX file that no CA has been allowed to issue since June 2023. What a signature on a onefile build really covers, why the runtime it unpacks into %TEMP% can never be signed, which build mode that decision should change, where the two signing steps belong in a release pipeline, and what the 460-day validity cap does to a script missing one flag.

    My-SSL TeamAug 29, 202614 min
    Installation

    How to Install an SSL Certificate on a FortiGate Firewall

    A FortiGate does not have one certificate — it has a slot for every service that speaks TLS, and each is selected in a different menu. Which slot you are actually being asked to fix, why generating the request on the box matters, the second import that everyone skips and only breaks the clients you are not watching, where the certificate goes now that FortiOS 7.6.3 has replaced SSL-VPN tunnel mode, and the one slot no public CA is allowed to sell you a certificate for.

    My-SSL TeamAug 28, 202614 min
    Installation

    How to Install an SSL Certificate on Proxmox VE

    Proxmox keeps three certificate files and only one of them is yours to write — the other two are what the cluster uses to trust itself, and their names differ by seven characters. Which file the web interface actually serves, why a shared filesystem still means running the install command once per node, the Backup Server fingerprint that quietly breaks tonight's job, and what the 200-day limit does to a three-node cluster that renews by hand.

    My-SSL TeamAug 28, 202614 min
    Code Signing

    Sharing One Code Signing Certificate Across a Team

    Since 1 June 2023 a code signing key stays in certified hardware, so a team shares access to one key instead of copies of it. The four routes to that key and what the CA/Browser Forum requires of each, what Certum documents (and does not) for using SimplySign on several computers, what Microsoft says about SmartScreen reputation across certificates, and why one certificate means 4 renewals in five years instead of 16.

    My-SSL TeamAug 27, 202610 min
    Guides

    SSL Certificates for Remote Desktop: Which Role Needs What

    Windows secures RDP with a certificate it issued to itself and quietly replaces it about every six months, which is why the identity warning keeps coming back and why ticking "don't ask me again" only buys you until the next rotation. A full Remote Desktop Services deployment exposes four separate certificate roles, each checked against a different name: which two actually need a publicly trusted issuer, why an internal CA is enough for the other two, where the name mismatch really happens on the internal hop, and how to bind a certificate on a single server that has no RDS roles at all.

    My-SSL TeamAug 27, 202614 min
    Guides

    Why OV and EV Validation Fails, and What Fixes It

    A certificate authority is not weighing your paperwork on its merits: the Baseline Requirements give it four permitted ways to verify an organisation, and anything your own company produced to get the certificate is excluded by definition. Which of the three checks your order is stuck on, why an established business with a working switchboard can still fail the phone verification, the address-only exception that clears most address holds within the hour, and the letter route for companies no database lists yet.

    My-SSL TeamAug 26, 202614 min
    Guides

    S/MIME for Teams: Key Custody and Offboarding

    Deploying S/MIME across a team turns private keys into company data, and the decision that costs money is taken before the first certificate is issued. Why a lost encryption key closes a mailbox archive permanently while a lost signing key costs an afternoon, why Google Workspace and Microsoft 365 answer the custody question in opposite directions, what to do about info@ and billing@, and the offboarding step that has to happen before the laptop is wiped.

    My-SSL TeamAug 26, 202613 min
    Security

    Root Certificate Expired? What Actually Breaks

    Three separate events get called "the root expired", and only one of them turns a working certificate into a browser warning. Why a root passing its own expiry date is usually a chain-building problem with a five-minute fix, what really broke in 2020 and 2021, and the number that has quietly replaced the printed expiry date: both Mozilla and Chrome now schedule a root out of the trust stores about fifteen years after its key was generated, which for a 2010 root with a 2038 date on it lands thirteen years early.

    My-SSL TeamAug 25, 202614 min

    All guides by topic

    Every guide in the Learning Hub, grouped by subject. 205 articles covering SSL/TLS certificates, code signing, S/MIME, PKI and server configuration.

    Code Signing

    28 guides

    SSL Basics

    16 guides

    Guides

    63 guides

    Security

    56 guides

    Comparisons

    13 guides

    Installation

    25 guides

    How these guides are written and reviewed

    Guides are written by Daniel Rehak and other contributors. Check each guide’s sources and date against the current issuer or platform documentation. My-SSL also sells certificates; product recommendations have a commercial relationship to this site. Send corrections with the page URL and supporting source.

    Where a rule has a future effective date, the guide states what applies today and marks the future change separately. The most recently updated guide in this library was updated on Oct 22, 2026.

    Named authors
    Primary-source references
    Publication and update dates