November 11, 2026 · 5 min read – What Are SAN and Wildcard Certificates?What Are SAN and Wildcard Certificates?
What Are SAN and Wildcard Certificates?
A certificate is not valid for “a website” but for specific names. Which names they are is set out in the Subject Alternative Name (SAN) extension. It can list several domains, or a wildcard that covers many subdomains in one go. This guide explains ... Continue Reading →
Why Certificate Lifetimes Are Shrinking to 47 Days
A little over ten years ago you could buy a website certificate valid for up to five years and forget about it. Today public certificates last at most 200 days, from March 2027 only 100 days, and from March 2029 just 47 days. The CA/Browser Forum agreed this in ... Continue Reading →
What Is Certificate Transparency? Logs, SCTs and Monitoring
Every certificate authority your browser trusts can, technically, issue a certificate for any domain, including yours. How would you know if one did so wrongly? The answer is Certificate Transparency (CT): every publicly trusted website certificate must be recorded ... Continue Reading →
How Certificate Revocation Works: CRL, OCSP and Stapling
A certificate is valid until its expiry date. But what if something goes wrong before then, for example because the private key has been stolen? Then the certificate authority must revoke the certificate, and browsers need to find out. That is harder than it sounds. ... Continue Reading →
What Is a Root Store? How Browsers Decide Which CAs to Trust
Every certificate chain ends at a root certificate that your device trusts from the outset. But who decides which root certificates those are? The answer lies in the root stores of operating systems and browsers, and the root programmes that run them. Between them, ... Continue Reading →
Certificate File Formats Explained: PEM, DER, PKCS#7 and PFX
Install a certificate and you soon meet a jumble of file extensions: .pem, .crt, .cer, .der, .key, .p7b, .pfx and .p12. One server wants two files, another wants a single file with a password, and sometimes a server rejects a file even though the certificate inside ... Continue Reading →
How to Create a Private Key and CSR With OpenSSL
Before a certificate authority can issue a certificate, it needs the public key it is going to vouch for. You hand it over in a certificate signing request, or CSR. The key pair and the CSR are created on your own machine, usually with the free OpenSSL toolkit. ... Continue Reading →
How Certificate Authorities Work: DV, OV and EV Explained
For a browser to trust a website’s certificate, the certificate must be signed by a certificate authority (CA). The CA vouches that whoever asked for the certificate really controls the domain and, for some certificate types, that a real organisation stands ... Continue Reading →
How the Certificate Chain of Trust Works
A certificate is only as trustworthy as the organisation that signed it. So how does your browser know it can trust that organisation? The answer is the chain of trust: from a website’s certificate, a series of signatures leads up to a root certificate that ... Continue Reading →
Recent Comments