Skip to main content
    My-SSL LogoMy-SSL
    Free Security Education

    SSL & Web Security Learning Center

    Expert guides and tutorials on SSL/TLS certificates, encryption, PKI, and digital security. Explore the bylines, dates and sources in each guide before applying it to your environment.

    199
    Guides published
    Oct 2, 2026
    Last guide updated
    Daniel Rehak
    Contributor articles
    Primary sources
    CA/B Forum, RFCs, vendor docs

    Browse by Topic

    Code Signing
    26 articles
    SSL Basics
    16 articles
    Guides & Tutorials
    61 articles
    Security
    55 articles
    Comparisons
    12 articles
    Installation
    25 articles
    SSL Configuration
    4 articles

    199 articles found

    Guides

    Using One SSL Certificate on Multiple Servers: Licences, Keys and Reissues

    One certificate can secure any number of servers, because nothing in TLS counts installations, but three separate questions get asked as one here. Which names the certificate covers is set by the request, how many servers may run it is a commercial licence term, and how many copies of the private key exist is decided every time you install. Why the copy-the-key habit stopped scaling when lifetimes fell to 200 days in March 2026, and when a free reissue per host is the better default.

    My-SSL TeamAug 22, 202613 min
    Guides

    SSL Certificates for Internal Server Names: The Four Options Left

    No publicly trusted CA has been allowed to certify a name like server01, anything ending in .local, or anything under the .internal domain since 1 November 2015, and the certificates that named one were revoked by October 2016. The four routes that remain, how split-horizon DNS and the ACME dns-01 challenge put a publicly trusted certificate on a host that answers nothing from outside, the pre-flight lookup that breaks most first attempts, and what certificate transparency publishes about your estate either way.

    My-SSL TeamAug 21, 202614 min
    Guides

    Signed EXE Flagged as a Virus: Why It Happens and How to Fix It

    A code signing certificate answers one of the three checks a Windows download passes, and the malware verdict is not it. Microsoft's own developer guidance says a signature will not bypass a behavioural classifier. How to tell which of the three gates actually stopped your build, why reputation is pooled across everything one certificate signs, the prevalence rule that blocks brand-new releases on managed fleets with no detection involved, and how to file a false positive that gets read.

    My-SSL TeamAug 21, 202613 min
    Guides

    SafeNet Authentication Client: Setup, PINs, and Fixing Token Errors

    The middleware that turns a plugged-in USB token into something SignTool, jarsigner, and browsers can actually use, and where most code signing setups now break. Which SafeNet 5110 model your CA shipped, why installing SAC and SafeNet Minidriver together produces the intermittent failures nobody can reproduce, the four checks that isolate a token-not-detected error, and why the Administrator PIN is the one secret nobody outside your team can help you recover.

    My-SSL TeamAug 20, 202612 min
    Security

    Code Signing Certificate Revoked: What Breaks and What to Do Next

    Revocation is the one certificate operation nobody can undo, and it lands unevenly: one date recorded by the CA splits your release history into signatures that keep validating and signatures that stop. Which side each build falls on, why the reason you give changes the blast radius, what a customer actually sees when a revoked chain is rejected, and the order to recover in. Containment first, replacement certificate last, because that is the step that takes days.

    My-SSL TeamAug 20, 202613 min
    Installation

    How to Install an SSL Certificate on vCenter Server (vSphere 8)

    Every guide to this opens with the certificate-manager menu. The question that decides the outcome comes earlier: a publicly trusted CA cannot issue for vcenter.corp.local, and a great many appliances are named exactly that. Which of the four vSphere certificate stores actually needs replacing, why the wildcard you already own is unusable, what the SubjectAltName and PNID have to agree on, and why a 200-day certificate on an appliance with no ACME client is a decision about maintenance windows rather than about one certificate.

    My-SSL TeamAug 19, 202614 min
    Guides

    SignTool Errors: What Each One Means and How to Fix It

    SignTool never touches your private key. It asks a cryptographic provider to do the signing, and since publicly trusted code signing keys were pushed into hardware in June 2023, that provider layer is where the failures live. What the hex code after SignerSign() failed actually identifies, the four buckets every failure sorts into, why a timestamp error never needs a re-sign, and a reference table for the HRESULTs you will actually see.

    My-SSL TeamAug 19, 202613 min
    Installation

    How to Install an SSL Certificate on a Synology NAS (DSM 7)

    DSM's built-in Let's Encrypt client speaks only the HTTP-01 challenge to one CA, so it needs port 80 reachable from the internet and the only wildcard it can issue is for a Synology DDNS hostname. That puts a lot of ordinary NAS setups on the import route by definition, not as a fallback. How to generate a CSR in DSM, which of the three files goes in which field, why the optional intermediate field is the one that breaks phone apps, and why a manual import now comes round about twice a year instead of once.

    My-SSL TeamAug 18, 202613 min
    Security

    Did AI Break AES? What Claude's HAWK and 7-Round AES Results Actually Mean

    In July 2026 Anthropic reported that Claude Mythos Preview halved the effective key strength of the HAWK post-quantum signature candidate and sped up the best known attack on seven-round AES by 200–800x. Neither result touches a production system. Here is what was actually found, why it matters anyway, and what a TLS or code signing operator should do about it.

    Daniel RehakAug 17, 202615 min
    Installation

    How to Install an SSL Certificate on Google Cloud (Load Balancer and Certificate Manager)

    Google Cloud has three separate certificate systems pointing at the same target proxy, and almost every guide covers only the oldest one. A proxy holds 15 Compute Engine SSL certificates or 100 Certificate Manager certificates. And if a certificate map is attached as well, the map is served and the directly attached certificates are ignored with no error at all. Why a self-signed certificate is refused on upload rather than merely distrusted, why a renewal is always a swap and never an edit, and what FAILED_NOT_VISIBLE is really telling you.

    My-SSL TeamAug 17, 202614 min
    Installation

    How to Install an SSL Certificate on Azure (App Service, Application Gateway and Key Vault)

    Azure has two certificate stores and most Azure TLS confusion starts with not knowing which one is in play. A PFX uploaded into App Service lives in a deployment unit tied to one resource group, region and OS, and Application Gateway cannot see it; a certificate in Key Vault is read by both — App Service syncing within 24 hours, the gateway polling every 4. Why the two services need different Key Vault roles, why a versioned secret URI silently stops renewal and disables the listener, and the OpenSSL 3 export flags Azure still expects.

    My-SSL TeamAug 17, 202614 min
    Installation

    How to Install an SSL Certificate on AWS (ACM, ALB and CloudFront)

    Every AWS guide stops at the import wizard. The part that decides how much this costs you comes afterwards: ACM never renews a certificate you imported, and since March 15, 2026 a public TLS certificate may not exceed 200 days — so the job returns roughly twice a year per Region, and about four times from March 2027. How to split the CA bundle into the three files ACM accepts, why CloudFront only reads us-east-1, and why reimporting to the existing ARN keeps every listener and Terraform reference pointing at the same identifier.

    My-SSL TeamAug 16, 202614 min

    All guides by topic

    Every guide in the Learning Hub, grouped by subject. 199 articles covering SSL/TLS certificates, code signing, S/MIME, PKI and server configuration.

    Code Signing

    26 guides

    SSL Basics

    16 guides

    Guides

    61 guides

    Security

    55 guides

    Installation

    25 guides

    How these guides are written and reviewed

    Guides are written by Daniel Rehak and other contributors. Check each guide’s sources and date against the current issuer or platform documentation. My-SSL also sells certificates; product recommendations have a commercial relationship to this site. Send corrections with the page URL and supporting source.

    Where a rule has a future effective date, the guide states what applies today and marks the future change separately. The most recently updated guide in this library was updated on Oct 2, 2026.

    Named authors
    Primary-source references
    Publication and update dates