SSLGuides.com is a practical reference for installing, migrating to, and troubleshooting SSL/TLS certificates. No jargon left unexplained, no step skipped — from your first certificate to your tenth server migration.
Point this at any hostname to see the certificate it's actually presenting — hostname match, chain, and expiry.
Answer one or two quick questions and we'll point you straight at the guide that matches — no browsing required.
What's going on?
What does the warning actually say?
The certificate being served doesn't cover the domain your browser is asking for — often a wrong server_name/vhost, a missing SAN entry, or the default site answering first.
Not sure which domain the cert actually covers? Check it with the tool above, or decode it with the SSL & CSR Decoder.
The browser can't build a path from your certificate up to a root it trusts — usually a missing intermediate certificate on the server.
The CA Chain Builder tool can assemble the missing intermediates for you.
This shows even for perfectly valid certificates when the client or server clock has drifted — worth ruling out before assuming the certificate itself is bad.
Use the checker above to confirm the actual valid-from/valid-until dates on the live certificate.
The connection is failing before a certificate is even exchanged — usually a TLS version or cipher mismatch, or the server not answering as expected on that port.
The OpenSSL Trace tool shows exactly where the handshake breaks down.
A revoked certificate needs reissuing, not just renewing — and a staging certificate showing up in production means the ACME client is pointed at the wrong environment.
Double-check revocation status with the OCSP Checker.
What's the actual situation?
The new certificate is usually sitting somewhere the traffic isn't reaching yet — a load balancer node, a CDN edge cache, or a service that wasn't restarted after renewal.
Use the checker above to see the dates the server is actually presenting right now.
Most renewal failures come down to a domain-validation step that can no longer complete — a changed DNS record, a firewall rule, or a control-panel integration quietly breaking.
Check whether validation would even succeed right now with the DCV Readiness Checker.
Once a certificate has genuinely lapsed, the fix is a fresh certificate — free automated ones for most cases, or a paid option if you need extended validation or long validity.
Where is it failing?
This almost always means curl's CA bundle can't verify the chain the server sends — even though your browser's much larger, auto-updated trust store can.
Trace exactly what the handshake sends with the OpenSSL Trace tool.
Same root cause as curl: Python's requests library ships its own CA bundle via certifi, independent of your OS or browser trust store.
UNABLE_TO_VERIFY_LEAF_SIGNATURE almost always means the server isn't sending its intermediate certificate(s) — Node is stricter about this than most browsers.
Confirm the chain the server is actually sending with the checker above, or the CA Chain Builder.
PKIX path building failed means the JVM's own cacerts truststore doesn't have what it needs to validate the chain — a separate trust store from your OS.
Postman validates certificates independently of your OS and has its own SSL settings that can be the actual cause, separate from the server's certificate itself.
What kind of site is it?
Usually an image, script, or stylesheet reference left over from before the HTTPS migration — the page itself loads securely, but one embedded resource still doesn't.
In a single-page app the offending request is often buried in a JS bundle, a third-party widget, or an API base URL set in an environment config — not visible in the page source.
Case studies from real, common troubleshooting patterns — how a specific problem actually got diagnosed and fixed.
A routine decision to start monitoring Certificate Transparency logs — made mostly to tick a compliance checkbox — caught a real, unauthorized certificate for the company's domain within hours of it being issued.
A routine security scan turned up something nobody wanted to find: a production private key, committed to a public GitHub repository, sitting there for half a year before anyone noticed.
A recurring annual line item nobody had questioned in years turned out to be buying almost nothing the company actually needed anymore — but retiring it required more thought than just letting it lapse.
Real, dated SSL/TLS industry events — CA/Browser Forum ballots, browser policy changes, CA incidents.
Compare wildcard, multi-domain, and OV/EV options from vendors we've reviewed.
Certificate authorities, tools we didn't build ourselves, and the standards bodies that actually write the rules.
