https://sslguides.com/ Practical guides for installing, migrating to, and troubleshooting SSL/TLS certificates. en-us https://sslguides.com/news/cabforum-ballot-required-ekus-cross-certified-cas.html https://sslguides.com/news/cabforum-ballot-required-ekus-cross-certified-cas.html Ballot SC103 would formally require EKU fields on cross-certified subordinate CAs, closing the gap behind Let's Encrypt's May outage. SSL News Fri, 11 Sep 2026 00:00:00 +0000 https://sslguides.com/news/aws-adds-mlkem-post-quantum-support.html https://sslguides.com/news/aws-adds-mlkem-post-quantum-support.html Three security-critical AWS services now support hybrid post-quantum key agreement using the NIST-standardized ML-KEM algorithm. SSL News Tue, 16 Jun 2026 00:00:00 +0000 https://sslguides.com/news/lets-encrypt-generation-y-cross-sign-incident.html https://sslguides.com/news/lets-encrypt-generation-y-cross-sign-incident.html A 2-hour-28-minute outage traced back to cross-signed certificates missing a required Extended Key Usage field. SSL News Thu, 14 May 2026 00:00:00 +0000 https://sslguides.com/news/digicert-g1-root-removal.html https://sslguides.com/news/digicert-g1-root-removal.html Chrome and Firefox stopped trusting DigiCert's older G1 root certificates on April 15 — a change that reaches every brand under the DigiCert umbrella, not just certificates sold directly under the DigiCert name. SSL News Thu, 16 Apr 2026 00:00:00 +0000 https://sslguides.com/news/sectigo-private-pqc-launch.html https://sslguides.com/news/sectigo-private-pqc-launch.html A new feature in Sectigo Certificate Manager lets enterprises issue and manage post-quantum certificates inside their existing workflows — without new infrastructure or tools. SSL News Wed, 15 Apr 2026 00:00:00 +0000 https://sslguides.com/news/techradar-october-certificate-expiry-warning.html https://sslguides.com/news/techradar-october-certificate-expiry-warning.html TechRadar Pro's analysis connects a specific date to the first 200-day certificates issued under this year's new validity rules: many of them expire in early October, all around the same time. SSL News Tue, 31 Mar 2026 00:00:00 +0000 https://sslguides.com/news/harica-mass-revocation-july-2026.html https://sslguides.com/news/harica-mass-revocation-july-2026.html Two separate CP/CPS violations — one involving the same clientAuth EKU issue rippling across the industry this year, another over a missing OCSP extension — forced back-to-back mass revocations. SSL News Sun, 26 Jul 2026 00:00:00 +0000 https://sslguides.com/news/harica-sanctioned-entities-controversy.html https://sslguides.com/news/harica-sanctioned-entities-controversy.html A security researcher's Bugzilla report documented active certificates issued to EU-sanctioned entities including Sberbank and VTB — and HARICA initially declined to revoke them. SSL News Fri, 17 Jul 2026 00:00:00 +0000 https://sslguides.com/news/chrome-clientauth-distrust-begins.html https://sslguides.com/news/chrome-clientauth-distrust-begins.html Chrome Root Program Policy v1.6 enforcement started June 15 — new public TLS certificates with both server and client authentication purposes are no longer trusted by default. SSL News Tue, 16 Jun 2026 00:00:00 +0000 https://sslguides.com/news/lets-encrypt-merkle-tree-certificates.html https://sslguides.com/news/lets-encrypt-merkle-tree-certificates.html The world's largest certificate authority is targeting a late-2026 staging rollout for MTCs — the same post-quantum architecture Google and Cloudflare proposed earlier this year. SSL News Sat, 06 Jun 2026 00:00:00 +0000 https://sslguides.com/news/lets-encrypt-generation-y-roots.html https://sslguides.com/news/lets-encrypt-generation-y-roots.html New roots, general availability for short-lived certificates, and the default classic ACME profile switching over — all landing in the same week. SSL News Thu, 14 May 2026 00:00:00 +0000 https://sslguides.com/news/200-day-certificate-cap-takes-effect.html https://sslguides.com/news/200-day-certificate-cap-takes-effect.html March 15 marked the first enforcement milestone of the CA/Browser Forum's phased plan to shrink maximum TLS certificate validity from 398 days down to 47 by 2029. SSL News Mon, 16 Mar 2026 00:00:00 +0000 https://sslguides.com/news/certbot-adds-ip-address-certificates.html https://sslguides.com/news/certbot-adds-ip-address-certificates.html Certbot 5.3 and 5.4 add flags for requesting certificates that secure a bare IP address rather than a domain name — a capability Let's Encrypt enabled for general use earlier this year. SSL News Thu, 12 Mar 2026 00:00:00 +0000 https://sslguides.com/news/lets-encrypt-retires-client-auth-eku.html https://sslguides.com/news/lets-encrypt-retires-client-auth-eku.html As of February 11, Let's Encrypt's default certificate profile no longer includes the TLS Client Authentication EKU — a change driven by Chrome's root program policy, not a Let's Encrypt-specific decision. SSL News Thu, 12 Feb 2026 00:00:00 +0000 https://sslguides.com/articles/ocsp-must-staple.html https://sslguides.com/articles/ocsp-must-staple.html A certificate extension that makes OCSP stapling mandatory rather than optional — and why adoption never really took off. SSL Basics Mon, 24 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/certificate-pinning-mobile-apps.html https://sslguides.com/articles/certificate-pinning-mobile-apps.html Hardcoding trust into a mobile app protects against a compromised CA — and creates a real risk of accidentally locking out your own users. How-To Mon, 24 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/expect-ct-header-history.html https://sslguides.com/articles/expect-ct-header-history.html A short-lived HTTP header that let sites opt into Certificate Transparency enforcement, made obsolete once browsers started requiring CT by default. SSL History Mon, 24 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/what-is-a-caa-record.html https://sslguides.com/articles/what-is-a-caa-record.html A DNS record type that names exactly which certificate authorities are permitted to issue for your domain. SSL Basics Mon, 24 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/lets-encrypt-vs-zerossl-vs-buypass.html https://sslguides.com/articles/lets-encrypt-vs-zerossl-vs-buypass.html Three certificate authorities now issue free, automated certificates via the same ACME protocol — what actually differs between them. SSL Basics Mon, 24 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/what-is-tls-renegotiation.html https://sslguides.com/articles/what-is-tls-renegotiation.html A mechanism for changing an already-established TLS connection's parameters mid-session — and the vulnerability that led to it being redesigned. SSL Basics Mon, 24 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/dns-01-validation-cloudflare.html https://sslguides.com/articles/dns-01-validation-cloudflare.html Automating wildcard certificate issuance through Cloudflare's DNS API, step by step. How-To Mon, 24 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/dns-01-validation-route53.html https://sslguides.com/articles/dns-01-validation-route53.html Automating wildcard certificate issuance through Route 53's API using an IAM policy scoped to exactly what's needed. How-To Mon, 24 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/cloudflare-universal-ssl-vs-own-certificate.html https://sslguides.com/articles/cloudflare-universal-ssl-vs-own-certificate.html When Cloudflare's free, automatic certificate is enough, and when installing your own on the origin server actually matters. How-To Mon, 24 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/fix-connection-not-private-android.html https://sslguides.com/articles/fix-connection-not-private-android.html Same underlying causes as desktop, with one Android-specific wrinkle worth checking. Troubleshooting Thu, 06 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/dv-ov-ev-certificates.html https://sslguides.com/articles/dv-ov-ev-certificates.html Three validation levels, three different amounts of paperwork — and what each one actually proves to a visitor. SSL Basics Wed, 05 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/what-is-certificate-pinning.html https://sslguides.com/articles/what-is-certificate-pinning.html A stricter trust model used mostly in mobile apps — and a common cause of mysterious connection failures. SSL Basics Wed, 05 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/does-https-affect-seo.html https://sslguides.com/articles/does-https-affect-seo.html Google confirmed it as a ranking signal in 2014 — the more interesting question is how much it still moves the needle. SSL Basics Tue, 04 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/fix-ssl-error-handshake-failure-openssl.html https://sslguides.com/articles/fix-ssl-error-handshake-failure-openssl.html Reading the specific alert OpenSSL reports narrows the cause far faster than guessing. Troubleshooting Tue, 04 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/force-https-joomla.html https://sslguides.com/articles/force-https-joomla.html Joomla's Force HTTPS setting works — until your server config disagrees with it. Here's the fix. HTTPS Migration Mon, 03 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/history-netscape-original-ssl.html https://sslguides.com/articles/history-netscape-original-ssl.html Built by a small team in the early 1990s to make e-commerce on the web plausible at all. SSL History Mon, 03 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/fix-err-cert-date-invalid.html https://sslguides.com/articles/fix-err-cert-date-invalid.html Either the certificate is expired, or the visitor's device clock is wrong. Troubleshooting Mon, 03 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/ssl-termination-at-load-balancer.html https://sslguides.com/articles/ssl-termination-at-load-balancer.html Terminate once, at the edge, and let backend servers stay simpler. How-To Guides Sun, 02 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/test-tls-protocol-cipher-support-openssl.html https://sslguides.com/articles/test-tls-protocol-cipher-support-openssl.html Confirm exactly which TLS versions your server accepts, one command per version. How-To Guides Sat, 01 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/flame-malware-md5-forgery.html https://sslguides.com/articles/flame-malware-md5-forgery.html A nation-state-grade attack that used a broken hash function to forge a Microsoft-trusted certificate. SSL History Sat, 01 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/fix-certificate-expired-when-it-isnt.html https://sslguides.com/articles/fix-certificate-expired-when-it-isnt.html Almost always caching — check what's actually being served, not what you assume is being served. Troubleshooting Sat, 01 Aug 2026 00:00:00 +0000 https://sslguides.com/articles/ecommerce-https-migration-pci.html https://sslguides.com/articles/ecommerce-https-migration-pci.html For a store handling payments, HTTPS migration intersects with compliance requirements that aren't optional. HTTPS Migration Fri, 31 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/https-redirect-nodejs-express.html https://sslguides.com/articles/https-redirect-nodejs-express.html A small piece of middleware — but only the right piece, depending on where TLS actually terminates. HTTPS Migration Fri, 31 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/fixing-redirect-loops-after-https.html https://sslguides.com/articles/fixing-redirect-loops-after-https.html Almost always one of three causes — here's how to tell which one you've got. HTTPS Migration Fri, 31 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/https-for-local-development.html https://sslguides.com/articles/https-for-local-development.html Sometimes plain localhost isn't enough — some browser APIs specifically require a secure context. How-To Guides Fri, 31 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/history-free-ssl-before-lets-encrypt.html https://sslguides.com/articles/history-free-ssl-before-lets-encrypt.html Free certificates existed before 2015 — just not at the scale or automation that changed the industry. SSL History Fri, 31 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/how-browsers-decide-trust.html https://sslguides.com/articles/how-browsers-decide-trust.html A checklist your browser runs through in milliseconds, every single time you load a page. SSL Basics Thu, 30 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/what-is-lets-encrypt.html https://sslguides.com/articles/what-is-lets-encrypt.html A nonprofit CA that made HTTPS free and automated — and quietly became the most-used certificate authority on the internet. SSL Basics Wed, 29 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/https-redirect-iis.html https://sslguides.com/articles/https-redirect-iis.html No built-in toggle — the redirect lives in an XML rewrite rule inside web.config. HTTPS Migration Wed, 29 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/history-superfish-lenovo-scandal.html https://sslguides.com/articles/history-superfish-lenovo-scandal.html 2015 — when pre-installed adware quietly undermined HTTPS for every affected laptop's owner. SSL History Wed, 29 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/diagnosing-ssl-with-openssl-playbook.html https://sslguides.com/articles/diagnosing-ssl-with-openssl-playbook.html A handful of commands that answer almost every "why is this certificate broken" question directly. Troubleshooting Wed, 29 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/set-up-hsts-preloading-step-by-step.html https://sslguides.com/articles/set-up-hsts-preloading-step-by-step.html A checklist before submitting, since removal from the list is slow and painful. How-To Guides Tue, 28 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/fix-nodejs-unable-to-verify-leaf-signature.html https://sslguides.com/articles/fix-nodejs-unable-to-verify-leaf-signature.html Node's trust store doesn't have the certificate chain it needs — check the actual chain, don't disable verification. Troubleshooting Tue, 28 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/https-subdomains-different-servers.html https://sslguides.com/articles/https-subdomains-different-servers.html Each server needs its own valid certificate — a wildcard doesn't magically cover infrastructure it isn't installed on. HTTPS Migration Mon, 27 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/https-redirect-heroku.html https://sslguides.com/articles/https-redirect-heroku.html Automatic Certificate Management plus one line of middleware, depending on your stack. HTTPS Migration Mon, 27 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/what-is-sni.html https://sslguides.com/articles/what-is-sni.html The trick that lets one IP address serve HTTPS for hundreds of unrelated domains. SSL Basics Sun, 26 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/does-ssl-affect-speed.html https://sslguides.com/articles/does-ssl-affect-speed.html Yes, measurably — and the number is much smaller than most people assume, especially since TLS 1.3. SSL Basics Sun, 26 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/https-migration-woocommerce.html https://sslguides.com/articles/https-migration-woocommerce.html WordPress's migration steps, plus the cart, session, and payment gateway complications WooCommerce adds on top. HTTPS Migration Sun, 26 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/history-tls-1-1-forgotten-version.html https://sslguides.com/articles/history-tls-1-1-forgotten-version.html Released in 2006, largely skipped by the industry's collective memory of TLS history. SSL History Sun, 26 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/history-chrome-root-program.html https://sslguides.com/articles/history-chrome-root-program.html Chrome moving to manage its own trust store independently of the underlying operating system. SSL History Sun, 26 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/what-is-perfect-forward-secrecy.html https://sslguides.com/articles/what-is-perfect-forward-secrecy.html A property that protects past conversations even if your private key leaks tomorrow. SSL Basics Sat, 25 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/fix-ssl-handshake-timeouts.html https://sslguides.com/articles/fix-ssl-handshake-timeouts.html Often a network-level or firewall issue rather than anything about the certificate itself. Troubleshooting Sat, 25 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/force-https-bigcommerce.html https://sslguides.com/articles/force-https-bigcommerce.html SSL is included by default on BigCommerce stores — here's where the enforcement setting actually lives. HTTPS Migration Fri, 24 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/https-reverse-proxy-setup.html https://sslguides.com/articles/https-reverse-proxy-setup.html Where the redirect and the certificate actually belong when Nginx sits in front of your app server. HTTPS Migration Fri, 24 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/fix-err-ssl-version-cipher-mismatch.html https://sslguides.com/articles/fix-err-ssl-version-cipher-mismatch.html The client and server share no compatible protocol version or cipher suite. Troubleshooting Fri, 24 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/why-certificates-expire.html https://sslguides.com/articles/why-certificates-expire.html It's not a business model. Short lifespans are a deliberate security control. SSL Basics Thu, 23 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/redirect-wordpress-to-https.html https://sslguides.com/articles/redirect-wordpress-to-https.html The exact order of operations — site URLs, .htaccess, mixed content, and the plugin shortcut. HTTPS Migration Thu, 23 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/fix-postman-ssl-certificate-errors.html https://sslguides.com/articles/fix-postman-ssl-certificate-errors.html A settings toggle exists for testing — use it carefully, and only when you understand why. Troubleshooting Thu, 23 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/ssl-for-email-server-smtp-imap.html https://sslguides.com/articles/ssl-for-email-server-smtp-imap.html Three different ports, three different historical conventions for where encryption starts. How-To Guides Wed, 22 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/configure-strong-tls-nginx.html https://sslguides.com/articles/configure-strong-tls-nginx.html A short, current configuration block rather than a hand-assembled cipher list. How-To Guides Wed, 22 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/history-sweet32-attack.html https://sslguides.com/articles/history-sweet32-attack.html 2016 — the vulnerability that finally ended 3DES's long career in TLS. SSL History Wed, 22 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/https-vs-http.html https://sslguides.com/articles/https-vs-http.html One letter, and an entire encrypted layer sitting underneath it. SSL Basics Mon, 20 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/free-vs-paid-ssl.html https://sslguides.com/articles/free-vs-paid-ssl.html The encryption is identical. What you're actually paying for is validation depth, warranty, and support. SSL Basics Mon, 20 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/rolling-back-https-migration-safely.html https://sslguides.com/articles/rolling-back-https-migration-safely.html The one setting that makes a clean rollback impossible if you've already flipped it. HTTPS Migration Mon, 20 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/wildcard-certificate-dns-validation.html https://sslguides.com/articles/wildcard-certificate-dns-validation.html Wildcard certificates specifically require DNS validation — HTTP validation isn't an option here. How-To Guides Mon, 20 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/history-acme-protocol-standardization.html https://sslguides.com/articles/history-acme-protocol-standardization.html A tool built for one CA became the open standard several others now use too. SSL History Mon, 20 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/fix-unable-to-get-local-issuer-certificate.html https://sslguides.com/articles/fix-unable-to-get-local-issuer-certificate.html The same underlying gap — a missing intermediate — showing up as three differently-worded errors. Troubleshooting Mon, 20 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/fix-email-client-certificate-trust-warnings.html https://sslguides.com/articles/fix-email-client-certificate-trust-warnings.html Usually a mail server certificate hostname mismatch, easy to overlook since it's a separate cert from your website. Troubleshooting Mon, 20 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/what-is-tls-termination.html https://sslguides.com/articles/what-is-tls-termination.html Where the encrypted connection actually ends — and it's often not where you'd assume. SSL Basics Sun, 19 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/https-migration-large-site-seo.html https://sslguides.com/articles/https-migration-large-site-seo.html The technical migration is the easy part. Protecting years of accumulated ranking signal is the actual project. HTTPS Migration Sun, 19 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/history-mobile-browsers-cert-trust.html https://sslguides.com/articles/history-mobile-browsers-cert-trust.html Stricter, less forgiving clients that pushed the whole industry toward more careful chain installation. SSL History Sun, 19 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/fixing-sni-misconfigurations.html https://sslguides.com/articles/fixing-sni-misconfigurations.html One server, several sites, and the specific configuration mistake that serves the wrong one. Troubleshooting Sun, 19 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/fix-err-ssl-protocol-error.html https://sslguides.com/articles/fix-err-ssl-protocol-error.html Often means plain HTTP is being served on the HTTPS port. Troubleshooting Sun, 19 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/http2-and-https.html https://sslguides.com/articles/http2-and-https.html No major browser will negotiate HTTP/2 without TLS, even though the spec technically allows it. SSL Basics Sat, 18 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/certificate-vs-key-pair.html https://sslguides.com/articles/certificate-vs-key-pair.html Two related but distinct things people often use interchangeably — worth untangling once, clearly. SSL Basics Sat, 18 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/secure-database-connection-tls.html https://sslguides.com/articles/secure-database-connection-tls.html Your website's padlock protects visitors. This is the encryption that protects the connection behind it. How-To Guides Sat, 18 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/certificate-auto-discovery-many-domains.html https://sslguides.com/articles/certificate-auto-discovery-many-domains.html AutoSSL and similar tools that issue certificates for every domain automatically, without a manual list. How-To Guides Sat, 18 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/force-https-webflow.html https://sslguides.com/articles/force-https-webflow.html One toggle in site settings — plus a note on what happens to your old http:// links. HTTPS Migration Fri, 17 Jul 2026 00:00:00 +0000 https://sslguides.com/articles/sha1-deprecation-history.html https://sslguides.com/articles/sha1-deprecation-history.html A decade-long, deliberately gradual retirement — and the research that finally proved it necessary. SSL History Fri, 17 Jul 2026 00:00:00 +0000