November 13, 2026 · 5 min read – How to Manage Certificates and Avoid Expiry OutagesHow to Manage Certificates and Avoid Expiry Outages
How to Manage Certificates and Avoid Expiry Outages
An expired certificate is one of the most mundane and yet most common causes of IT outages. The server is running, the network works, and still nobody can connect, because a date has passed. As certificate lifetimes shrink, managing certificates becomes a permanent ... Continue Reading →
What Is Certificate Pinning? HPKP and Pinning in Apps
Normally a browser accepts any valid certificate that leads to a trusted root, whichever of the many certificate authorities issued it. Certificate pinning narrows that down: a program accepts only a specific certificate or key for a particular server. That protects ... Continue Reading →
What Is S/MIME? Signed and Encrypted Email Explained
An ordinary email is like a postcard: the sender can be faked, and every server along the way can read it. S/MIME changes that with certificates. A signed email proves who sent it and that it arrived unchanged; an encrypted email can only be read by the recipient. ... Continue Reading →
How Code Signing Works: Signed Software Explained
When you download and run a program, your operating system quietly checks who made it and whether it has been changed since. That is possible thanks to code signing: software makers sign their programs digitally with a key that belongs to a certificate. This guide ... Continue Reading →
What Is an HSM? Hardware Security Modules and TPMs Explained
A certificate is only as secure as the private key behind it. If that key sits in a file on a server, anyone who takes over the server can copy it, and nobody will notice the copy. That is why valuable keys belong in hardware they cannot leave: in a hardware security ... Continue Reading →
How to Run a Private Certificate Authority
For public websites, a certificate authority such as Let’s Encrypt is the right choice. But many certificates are never checked by strangers’ browsers at all: servers on a company network, devices, VPN gateways, client certificates or services in Kubernetes. ... Continue Reading →
What Is Mutual TLS (mTLS)? Client Certificates Explained
On an ordinary HTTPS connection only the server proves who it is: it presents its certificate and the browser checks it. Who the visitor is gets settled afterwards by the website, with a password or a passkey. With mutual TLS (mTLS), the client presents a certificate ... Continue Reading →
What Are CAA Records, DNSSEC and DANE?
Every certificate authority in the root stores is, in principle, allowed to issue for any domain. As a domain owner you can restrict that, and you do it where your domain is already managed: in DNS. A CAA record states which CAs may issue certificates for your ... Continue Reading →
What Are SAN and Wildcard Certificates?
A certificate is not valid for “a website” but for specific names. Which names they are is set out in the Subject Alternative Name (SAN) extension. It can list several domains, or a wildcard that covers many subdomains in one go. This guide explains ... Continue Reading →
Recent Comments