Skip to main content
    My-SSL LogoMy-SSL
    Free Security Education

    SSL & Web Security Learning Center

    Expert guides and tutorials on SSL/TLS certificates, encryption, PKI, and digital security. Explore the bylines, dates and sources in each guide before applying it to your environment.

    205
    Guides published
    Oct 22, 2026
    Last guide updated
    Daniel Rehak
    Contributor articles
    Primary sources
    CA/B Forum, RFCs, vendor docs

    Browse by Topic

    Code Signing
    28 articles
    SSL Basics
    16 articles
    Guides & Tutorials
    63 articles
    Security
    56 articles
    Comparisons
    13 articles
    Installation
    25 articles
    SSL Configuration
    4 articles

    205 articles found

    Guides

    SignTool Errors: What Each One Means and How to Fix It

    SignTool never touches your private key. It asks a cryptographic provider to do the signing, and since publicly trusted code signing keys were pushed into hardware in June 2023, that provider layer is where the failures live. What the hex code after SignerSign() failed actually identifies, the four buckets every failure sorts into, why a timestamp error never needs a re-sign, and a reference table for the HRESULTs you will actually see.

    My-SSL TeamAug 19, 202613 min
    Installation

    How to Install an SSL Certificate on a Synology NAS (DSM 7)

    DSM's built-in Let's Encrypt client speaks only the HTTP-01 challenge to one CA, so it needs port 80 reachable from the internet and the only wildcard it can issue is for a Synology DDNS hostname. That puts a lot of ordinary NAS setups on the import route by definition, not as a fallback. How to generate a CSR in DSM, which of the three files goes in which field, why the optional intermediate field is the one that breaks phone apps, and why a manual import now comes round about twice a year instead of once.

    My-SSL TeamAug 18, 202613 min
    Security

    Did AI Break AES? What Claude's HAWK and 7-Round AES Results Actually Mean

    In July 2026 Anthropic reported that Claude Mythos Preview halved the effective key strength of the HAWK post-quantum signature candidate and sped up the best known attack on seven-round AES by 200–800x. Neither result touches a production system. Here is what was actually found, why it matters anyway, and what a TLS or code signing operator should do about it.

    Daniel RehakAug 17, 202615 min
    Installation

    How to Install an SSL Certificate on Google Cloud (Load Balancer and Certificate Manager)

    Google Cloud has three separate certificate systems pointing at the same target proxy, and almost every guide covers only the oldest one. A proxy holds 15 Compute Engine SSL certificates or 100 Certificate Manager certificates. And if a certificate map is attached as well, the map is served and the directly attached certificates are ignored with no error at all. Why a self-signed certificate is refused on upload rather than merely distrusted, why a renewal is always a swap and never an edit, and what FAILED_NOT_VISIBLE is really telling you.

    My-SSL TeamAug 17, 202614 min
    Installation

    How to Install an SSL Certificate on Azure (App Service, Application Gateway and Key Vault)

    Azure has two certificate stores and most Azure TLS confusion starts with not knowing which one is in play. A PFX uploaded into App Service lives in a deployment unit tied to one resource group, region and OS, and Application Gateway cannot see it; a certificate in Key Vault is read by both — App Service syncing within 24 hours, the gateway polling every 4. Why the two services need different Key Vault roles, why a versioned secret URI silently stops renewal and disables the listener, and the OpenSSL 3 export flags Azure still expects.

    My-SSL TeamAug 17, 202614 min
    Installation

    How to Install an SSL Certificate on AWS (ACM, ALB and CloudFront)

    Every AWS guide stops at the import wizard. The part that decides how much this costs you comes afterwards: ACM never renews a certificate you imported, and since March 15, 2026 a public TLS certificate may not exceed 200 days — so the job returns roughly twice a year per Region, and about four times from March 2027. How to split the CA bundle into the three files ACM accepts, why CloudFront only reads us-east-1, and why reimporting to the existing ARN keeps every listener and Terraform reference pointing at the same identifier.

    My-SSL TeamAug 16, 202614 min
    Security

    MPIC: Why Domain Validation Now Fails From Places You Don't Serve

    Every explainer covers what Multi-Perspective Issuance Corroboration is and the BGP hijack it was built to stop. Almost none carry the 2026 escalation: since June 15, 2026 a CA must corroborate domain control from four remote network perspectives spanning two internet registry regions, rising to five in December. The quorum has stayed at one allowed disagreement the whole time, so the tolerance is flat while the ways to spend it have more than doubled — and geo-blocking, split-horizon DNS and firewall allowlists are where it gets spent.

    My-SSL TeamAug 14, 202612 min
    Security

    OV and EV Revalidation: The 398-Day Clock on Your Company Data

    Everything written about the 2026 changes charts the shrinking certificate lifetime. One number went the other way and stopped: since March 15, 2026 a CA may reuse your validated company data for 398 days instead of 825, which turned OV re-verification from a once-every-two-years event into an annual one. Why EV customers noticed nothing, when the 398 days actually start counting, and why the one step nobody can automate now gates four certificate cycles in 2027 and eight in 2029.

    My-SSL TeamAug 14, 202613 min
    Security

    Every Public CA Must Support Certificate Automation by March 2027

    Almost everything written about 2027 says the same thing: lifetimes drop to 100 days, so you must automate. The other half of the story sits in Chrome Root Program policy — from March 15, 2027 every publicly trusted CA has to offer automated issuance and renewal for every certificate profile it sells, OV and EV included, and prove it works. What the rule actually requires, who it binds, and why a compliance failure hits your next issuance rather than your live certificate.

    My-SSL TeamAug 13, 202612 min
    Guides

    How to Set Up S/MIME in Apple Mail (macOS and iPhone)

    One certificate, two completely different installers: macOS imports the PKCS#12 into Keychain Access, while iPhone takes the same file as a configuration profile behind your device passcode. The exact steps for each, where iOS 18 moved the settings, and why a correctly installed certificate still refuses to encrypt.

    My-SSL TeamAug 13, 202613 min
    Security

    The clientAuth EKU Removal: Why Public TLS Certificates No Longer Authenticate Clients

    Publicly trusted TLS certificates can no longer carry the client authentication EKU, so a public certificate can identify a server but never the party connecting to one. The dates that already passed, why the last dual-purpose certificates expire around December 1, 2026, how to check a certificate's extended key usage, and how to move client credentials to a private CA.

    My-SSL TeamAug 13, 202613 min
    Security

    S/MIME Certificate Validation Types: Mailbox, Organization, Sponsor and Individual

    Every publicly trusted S/MIME certificate is one of four types, and the difference is whose identity the CA verified alongside the mailbox. What each type proves, what the Legacy, Multipurpose and Strict generations change, the full policy OID table, and how to read the type out of a certificate you already hold.

    My-SSL TeamAug 12, 202614 min

    All guides by topic

    Every guide in the Learning Hub, grouped by subject. 205 articles covering SSL/TLS certificates, code signing, S/MIME, PKI and server configuration.

    Code Signing

    28 guides

    SSL Basics

    16 guides

    Guides

    63 guides

    Security

    56 guides

    Comparisons

    13 guides

    Installation

    25 guides

    How these guides are written and reviewed

    Guides are written by Daniel Rehak and other contributors. Check each guide’s sources and date against the current issuer or platform documentation. My-SSL also sells certificates; product recommendations have a commercial relationship to this site. Send corrections with the page URL and supporting source.

    Where a rule has a future effective date, the guide states what applies today and marks the future change separately. The most recently updated guide in this library was updated on Oct 22, 2026.

    Named authors
    Primary-source references
    Publication and update dates