Skip to main content
    My-SSL LogoMy-SSL
    Free Security Education

    SSL & Web Security Learning Center

    Expert guides and tutorials on SSL/TLS certificates, encryption, PKI, and digital security. Explore the bylines, dates and sources in each guide before applying it to your environment.

    199
    Guides published
    Oct 2, 2026
    Last guide updated
    Daniel Rehak
    Contributor articles
    Primary sources
    CA/B Forum, RFCs, vendor docs

    Browse by Topic

    Code Signing
    26 articles
    SSL Basics
    16 articles
    Guides & Tutorials
    61 articles
    Security
    55 articles
    Comparisons
    12 articles
    Installation
    25 articles
    SSL Configuration
    4 articles

    199 articles found

    Security

    MPIC: Why Domain Validation Now Fails From Places You Don't Serve

    Every explainer covers what Multi-Perspective Issuance Corroboration is and the BGP hijack it was built to stop. Almost none carry the 2026 escalation: since June 15, 2026 a CA must corroborate domain control from four remote network perspectives spanning two internet registry regions, rising to five in December. The quorum has stayed at one allowed disagreement the whole time, so the tolerance is flat while the ways to spend it have more than doubled — and geo-blocking, split-horizon DNS and firewall allowlists are where it gets spent.

    My-SSL TeamAug 14, 202612 min
    Security

    OV and EV Revalidation: The 398-Day Clock on Your Company Data

    Everything written about the 2026 changes charts the shrinking certificate lifetime. One number went the other way and stopped: since March 15, 2026 a CA may reuse your validated company data for 398 days instead of 825, which turned OV re-verification from a once-every-two-years event into an annual one. Why EV customers noticed nothing, when the 398 days actually start counting, and why the one step nobody can automate now gates four certificate cycles in 2027 and eight in 2029.

    My-SSL TeamAug 14, 202613 min
    Security

    Every Public CA Must Support Certificate Automation by March 2027

    Almost everything written about 2027 says the same thing: lifetimes drop to 100 days, so you must automate. The other half of the story sits in Chrome Root Program policy — from March 15, 2027 every publicly trusted CA has to offer automated issuance and renewal for every certificate profile it sells, OV and EV included, and prove it works. What the rule actually requires, who it binds, and why a compliance failure hits your next issuance rather than your live certificate.

    My-SSL TeamAug 13, 202612 min
    Guides

    How to Set Up S/MIME in Apple Mail (macOS and iPhone)

    One certificate, two completely different installers: macOS imports the PKCS#12 into Keychain Access, while iPhone takes the same file as a configuration profile behind your device passcode. The exact steps for each, where iOS 18 moved the settings, and why a correctly installed certificate still refuses to encrypt.

    My-SSL TeamAug 13, 202613 min
    Security

    The clientAuth EKU Removal: Why Public TLS Certificates No Longer Authenticate Clients

    Publicly trusted TLS certificates can no longer carry the client authentication EKU, so a public certificate can identify a server but never the party connecting to one. The dates that already passed, why the last dual-purpose certificates expire around December 1, 2026, how to check a certificate's extended key usage, and how to move client credentials to a private CA.

    My-SSL TeamAug 13, 202613 min
    Security

    S/MIME Certificate Validation Types: Mailbox, Organization, Sponsor and Individual

    Every publicly trusted S/MIME certificate is one of four types, and the difference is whose identity the CA verified alongside the mailbox. What each type proves, what the Legacy, Multipurpose and Strict generations change, the full policy OID table, and how to read the type out of a certificate you already hold.

    My-SSL TeamAug 12, 202614 min
    Security

    Certificate Trust Stores: Why One Certificate Works in Chrome and Fails in Java

    There is no single trust store on a machine. Chrome ships its own on every platform except iOS, Java validates against a cacerts file that only changes when you update the JDK, and Node, Python and curl each read a bundle of their own. Why the same certificate passes in one and fails in another, and how to read the lists yourself.

    My-SSL TeamAug 12, 202615 min
    Guides

    How to Set Up S/MIME in Google Workspace (Gmail)

    Google splits this across four help pages, so people stall at whichever gate doesn't apply to them. Which editions actually include hosted S/MIME, why Business Plus isn't one of them, the root certificate rule most internal CAs fail, and the only way to deploy past a handful of mailboxes.

    My-SSL TeamAug 12, 202614 min
    Guides

    Java Keytool Commands Cheat Sheet: Keystore, CSR, Import and Trust

    Two details break more Java certificate installs than everything else: the SAN extension does not carry over into the CSR, and importing the CA's reply under a new alias returns success while storing something no server can use. Verified against OpenJDK 21.

    Daniel RehakAug 11, 202616 min
    Installation

    How to Install an SSL Certificate on Exchange Server

    Importing the certificate is the half of the job nobody notices is unfinished. The two commands that replace the admin center steps Microsoft removed, which names a public CA will refuse to issue, and why the Services column stays empty until you bind it yourself.

    My-SSL TeamAug 11, 202615 min
    Security

    PCI DSS SSL/TLS Certificate Requirements: What v4.0.1 Actually Says

    PCI DSS never names EV, OV or DV — a domain-validated certificate satisfies the text. What Requirements 4.2.1, 4.2.1.1 and 12.3.3 really ask of your certificates, why two of them only became mandatory in March 2025, and how 200-day lifetimes doubled the work behind them.

    My-SSL TeamAug 10, 202613 min
    Guides

    Using a Commercial CA With cert-manager in Kubernetes

    cert-manager is not a Let's Encrypt client. What External Account Binding actually does, which validation levels a paid ACME endpoint can issue on its own, and what to do with the OV certificate that arrives as an email attachment instead.

    My-SSL TeamAug 9, 202614 min

    All guides by topic

    Every guide in the Learning Hub, grouped by subject. 199 articles covering SSL/TLS certificates, code signing, S/MIME, PKI and server configuration.

    Code Signing

    26 guides

    SSL Basics

    16 guides

    Guides

    61 guides

    Security

    55 guides

    Installation

    25 guides

    How these guides are written and reviewed

    Guides are written by Daniel Rehak and other contributors. Check each guide’s sources and date against the current issuer or platform documentation. My-SSL also sells certificates; product recommendations have a commercial relationship to this site. Send corrections with the page URL and supporting source.

    Where a rule has a future effective date, the guide states what applies today and marks the future change separately. The most recently updated guide in this library was updated on Oct 2, 2026.

    Named authors
    Primary-source references
    Publication and update dates