TLS Radar Team

Recent posts

• LogJam (CVE-2015-4000)

  Imagine a combination lock with only three digits. It does its job in the sense that there is a locking mechanism. It clicks shut. The dial turns. From a distance, it's a lock. Up close, a determined

• Post-Mortem Patterns: Why TLS Outages Are Always "Surprising

  You don't usually discover a roof leak in the middle of a sunny afternoon. You discover it during the storm - water dripping onto the kitchen counter, a brown stain spreading across the ceiling. The l

• TLS 1.0 and 1.1: Why They're Still Running and How to Find Them

  In the back office of an otherwise modern company, there is often a fax machine. It is plugged in. It is occasionally used. There is exactly one customer - a hospital, a court, a regulator, an insuran

• The Compliance Calendar: TLS Tasks by Framework, by Quarter

  A gardener knows the calendar. Spring is for planting. Summer is for watering and deadheading. Autumn is for pruning and clearing leaves. Winter is for the long, slow jobs - mulching, planning, orderi

• Sectigo Certificate Manager Alternatives

  A lot of people have the same phone plan they got at university. Not because it's the best plan. Not because they've shopped around. Because switching feels like work, the bill is auto-paid, and on mo

• Cert Monitoring vs. Cert Management: Pick the Right Hammer

  Cert monitoring, lifecycle management, issuance, and discovery are four different categories that vendor marketing blurs together. What each one does, why they aren't interchangeable, and a practical diagnostic for which you actually need.

• PCI-DSS for E-commerce: TLS Requirements That Actually Matter

  A jewelry store with a window display has a particular kind of security problem. The display has to look good - that's the point. It has to be visible from the street. It has to invite people in. It a

• Eight eMudhra Intermediate Certificates Were Compromised. What It Means for Your Site

  Mozilla disclosed that the private keys of eight eMudhra intermediate certificates were compromised. Firefox blocked them within three hours, and eMudhra and Sectigo revoked all 16 copies. Which certificates are affected, why it matters even if you never used eMudhra, and what to check.

• GoDaddy Is Revoking 404,607 Certificates Because They Don't Match Its Own Rulebook

  GoDaddy is revoking 404,607 TLS certificates because the policy lines inside them don't match its own published rulebook, and it has missed the five-day deadline. What went wrong, which certificates are affected, and what to do before yours is revoked.

• The Hidden Outage: When Your Cert is Valid But Your Site Still Breaks

  Imagine a small restaurant. The door is unlocked. The lights are on. The kitchen is running. The food is fine. But a "Closed" sign is still hanging in the window from last Tuesday's day off, and nobod

• Hostname Mismatch and SAN Sprawl

  At a private wedding, the bouncer has a list. Names of approved guests. They check each arrival against the list. If your name's on it, you're in. If it isn't, you're not, even if you're standing next

• Your Certificate Will Get Revoked if It Started More Than 48 Hours Before Actual Issuance

  If your certificate's start date is more than 48 hours before it was actually issued, industry rules call that backdated, and your CA has 5 days to revoke it once it finds out. Nothing is wrong on your end. Here's what backdating means, a real 2026 example, and what TLS Radar checks for it.

• Building Audit-Ready TLS Evidence (Free Template)

  When you travel internationally, the careful traveller keeps a folder. Not metaphorically - a literal folder, or a phone wallet, or a screenshot album. In it: a copy of the passport, the visa, hotel c

• BEAST Attack (Browser Exploit Against SSL/TLS)

  Imagine standing behind someone at an ATM. They type their PIN. You can't see the screen, but you can see their finger movements - which row of the keypad they hover over before pressing. Combined wit

• What Is a Dual-Use Certificate, and How to Know if Chrome Will Reject My Certificate on March 15, 2027

  A dual-use certificate lists both server and client authentication in the same certificate. Chrome's root program rejects one issued on or after March 15, 2027. Here's what the two settings mean, how to check your own certificate in one command, and what over 118 million already-issued certificates mean for you.

• TLS Incidents Have Five Categories. Most Teams Diagnose Each One From Scratch.

  Every TLS outage maps to one of five categories. Structured diagnostics + diagnostic-rich alerts compress incident MTTR from hours to minutes.

• Multi-Cloud Certificate Inventory: Why It's Harder Than It Looks

  Imagine you've stored your possessions across three garages owned by three different friends. The friend with the suburban house. The friend with the city flat. The friend with the holiday cabin. You

• How to Find Out if My Certificate Was Revoked?

  Revocation doesn't change your certificate file, so you can't tell by looking at it. Here's how revocation checking actually works, why a one-off check is only a snapshot, and what it means when even the check itself is broken.

• AppViewX Alternatives: When You Need Monitoring, Not Lifecycle Management

  Imagine buying a programmable industrial sewing machine - the kind that does intricate embroidery, runs custom patterns, and integrates with a CAD system - when all you actually need is a button reatt

• Browsers Stopped Trusting Your Valid Certificate Because an Intermediate Certificate Was Revoked by Your CA Vendor

  Your certificate can be valid and correct, and browsers will still stop trusting it if your CA revokes the intermediate certificate behind it. Four CAs missed a hard revocation deadline in September 2026. Here's what that means for your site, and what TLS Radar now checks for it.

• When Your Customers' Certificates Become Your Problem

  Your SaaS uptime is held hostage by customer DNS and certificate hygiene. The trust-shift problem in custom-domain platforms and what to do about it.

• What an Expired Certificate Actually Does to Your Conversion Rate

  A restaurant with a public health notice taped to its door is still, technically, a restaurant. The food might be fine. The chef might be excellent. The seasonal menu might be the best in the city. Bu

• Chain Validation Pitfalls (And Why Cross-Signing Bites)

  When you write a letter of recommendation, the letter only works if the recipient recognises the recommender. A letter from Dr. Smith means something to the admissions committee that knows Dr. Smith.

• TLS Certificate Evidence Auditors Actually Want

  SOC 2, PCI, ISO, HIPAA - the controls converge on the same set of questions about cert inventory, lifecycle, and alerting. What continuous evidence collection looks like.

• ISO 27001 Annex A.10 (and A.8.24), Mapped to Certificate Controls

  At school, the best maths teachers had a rule: "show your work." Getting the right answer wasn't enough. You had to show - step by step, line by line - how you got there. The point wasn't to be pedant

• ROBOT Attack (Return Of Bleichenbacher's Oracle Threat)

  Imagine a safe with a slightly badly designed combination keypad. When you enter the wrong combination, the safe doesn't just say "wrong." It says - by the sound of the latch, the speed of the locking

• The Cert Renewed. Was It Actually Deployed?

  At 47-day validity, the gap between 'issued' and 'deployed' is where most cert outages now happen. Six ways deployment fails after renewal succeeds.

• Inheriting a PKI Mess: The First 90 Days

  When you buy an old house, you don't just inherit the walls. You inherit the previous owner's accumulated decisions. The wallpaper they chose in 1997. The boiler they replaced in 2014 with the cheapes

• SSL.com Revoked 2,700 Certificates in 24 Hours After an Audit Found a Missing Check

  An annual WebTrust audit found four sampled certificates with no evidence that multi-perspective domain validation was performed. The full investigation found 2,700, and SSL.com revoked them all within a day. What MPIC is, why you could not have seen this one coming, the second SSL.com incident you can check for yourself, and what TLS Radar's new revocation checking does about it.

• DigiCert vs Venafi: An Honest Comparison

  When your car needs servicing, you have two reasonable options. You can take it to the dealership where you bought it. They specialise in cars of that brand. They have the tools, the parts, and the se

• The Certificates You Don't Know About

  Most teams underestimate certificate count by 2-3x. Where shadow certs hide (cloud consoles, vendor portals, internal CAs), why CT log monitoring isn't enough, and how to fix it.

• Your Certificate's Country and State Fields Might Not Agree. CAs Have Revoked Certs For This.

  TLS Radar now checks whether a certificate's country code and state/province are internally consistent - the exact class of error that got GlobalSign and Sectigo forced into mass revocations. Runs on every scan, free or full.

• The Cert Renewal Game of Telephone: When Ownership Falls Through the Cracks

  When you played telephone as a kid, the rules were simple. Someone whispers a sentence into the first person's ear. That person whispers what they heard to the next person. By the time the message rea

• Certificate Revocation in 2026: CRL, OCSP, CRLite, and What's Coming

  How TLS certificate revocation works in 2026 - CRL, OCSP, OCSP stapling, and browser-pushed lists like CRLite - what's broken about it, why OCSP is winding down, and what your team should actually do about it.

• The Silent TLS Failures Your Expiry Monitor Doesn't Catch

  Expiry is the loudest failure mode but rarely the one that takes production down. Four silent failures - chain breaks, weak ciphers, hostname mismatches, OCSP revocation - and why they require different monitoring.

• HIPAA + TLS: The Certificate Compliance Angle

  When you write something on a postcard, anyone who handles it can read it. The postman. The sorter. The person who picks it out of the mailbox. The neighbour who happened to be in the lobby. The postc

• Keychest Alternatives: When You Outgrow It

  When you first move out, the studio apartment is great. It is exactly the right size. The rent is manageable. You can clean the whole place in twenty minutes. You can shout from the kitchen to the fro

• What Two Weeks of CA Compliance Incidents Say About Your Revocation Risk

  In the two weeks ending August 27, 2026, more than 30 public CAs logged 69 compliance incidents in Mozilla's tracker - delayed revocations, country-field and clientAuth misissuance, and the process failures that precede distrust. Every incident sourced to its Bugzilla bug, grouped by what it means for the certificates your business depends on.

• Retire Your Renewal Monitoring Cron Job

  Every engineering team eventually writes a renewal monitoring script. Then it silently breaks. Eight specific ways your cron decays, and what to do instead.

• ACME at Enterprise Scale: Pitfalls and Patterns

  A revolving door is a small, elegant piece of engineering. It controls the flow of people. It keeps heat in. It looks nice. At a small office building, it works perfectly - twenty or thirty people pas

• Heartbleed (CVE-2014-0160)

  Imagine paying for a coffee at a café. You give the cashier a £5 note. They give you £3.50 in change, plus - because they're not paying attention - a small handful of receipts, business cards, and wha

• Certificate Monitoring at Enterprise Scale

  At 5,000 certs, the failure modes that matter are different from the ones that matter at 50. What scale actually breaks, and what enterprise monitoring requires.

• Your CA Can Revoke Your Certificate Any Day. Are You Watching?

  One CA revoked 1.7 million certificates in 24 hours on April 3, 2026, following a compliance-driven mandatory revocation event. Five categories of mass revocation triggers, the timeline between revocation and customer impact, and why internal monitoring misses all of them.

• The 3am Cert Expiry: Why Outages Always Happen at the Worst Time

  The car never breaks down in the driveway.

• Build vs. Buy: In-House TLS Monitoring at Enterprise Scale

  Some people roast their own coffee. They buy green beans, weigh them out, use a small drum roaster, time the first crack, listen for the second crack, cool the beans, rest them, grind them fresh, and

• TLS and SSL Errors Explained (Every Browser, Every Code)

  Every TLS/SSL error - NET::ERR_CERT_*, SEC_ERROR_*, Safari's plain-English warnings, curl's cert errors - collapses into six root causes. What each one means, which browsers use which codes for it, and how to diagnose your own certificate in 30 seconds.

• Certificate Validity Is Shrinking. Your Renewal Process Has to Keep Up.

  200-day max validity took effect in March 2026, 100-day in 2027, 47-day in 2029. What this breaks in manual processes and what automation actually requires.

• The Post-Quantum TLS Migration Playbook for Enterprises

  A homeowner in a coastal region doesn't wait until the storm is on top of them to put up shutters. They watch the forecast. When a serious hurricane is named - even if it's still days out, still uncer

• Red Sift Certificates Alternatives

  Buying Red Sift Certificates because you need cert monitoring is a bit like buying a Swiss Army knife because you need a screwdriver. The screwdriver is in there. It's a fine screwdriver. You will als

• What 'Your Connection Is Not Private' Actually Costs You

  Browser certificate warnings have a ~90% bounce rate. Worked numbers on direct revenue loss, SEO recovery, trust decay, and the structural fix.

• The Let's Encrypt Mass Revocation Simulation Was a Warning to Every TLS Customer

  On March 19, 2026, Let's Encrypt simulated a 3 million cert mass revocation. Two weeks later, another CA revoked 1.7 million real certificates in 24 hours. Both events told the same story: your CA can revoke your cert for reasons you don't control, and most renewal automation won't respond in time.

• HARICA Revoked 63,525 Certificates in Five Days. Here's Why.

  A mid-sized public CA's internal compliance documentation fell out of sync with its issuance system, forcing two separate mass revocations in July 2026. What happened, why it isn't a HARICA-specific problem, and how to check whether you're exposed to the next one.

• Building a TLS Incident Runbook (Free Template)

  The time to plan a fire drill is not during a fire.

• Weak Cipher Suites Still Running in Production

  Most gym lockers have a padlock. The padlock clicks shut. It looks secure. To anyone glancing at it, the locker is locked. To anyone with a YouTube video and ninety seconds, it isn't.

• Reporting TLS Risk to Your Board

  Quantified exposure, trend lines, peer comparison. How to talk about cert risk in terms leadership cares about, and the quarterly cadence that builds budget approval.

• Fix Browser Security Warnings in Microsoft Edge

  Microsoft Edge inherits Chromium's TLS validation, including which CA roots it trusts, and uses the Windows certificate trust store. Map each error to its fix, with attention to Windows-specific trust store and Group Policy specifics.

• Fix Browser Security Warnings in Brave

  Brave inherits Chromium's TLS validation, including which CA roots it trusts. Map each NET::ERR_CERT_* error code to its cause and fix, plus a few Brave-specific gotchas (Shields, Tor windows).

• SOC 2 and TLS: What Auditors Actually Check

  A SOC 2 audit is not like going to the dentist. The dentist has a known procedure. They clean your teeth, count them, look for cavities, and send you home with a small toothbrush. The visit fits in a

• The Certificate Inventory Problem (And Why Yours Is Wrong)

  Open your garage. Now name everything in it. Not "boxes, bikes, the lawnmower." Specifically: what's in the boxes? How many bikes? Whose tools are in the cabinet you haven't opened since 2022?

• Post-Quantum TLS in 2026: What's Deployed, and the Certificate Problem

  Where post-quantum TLS actually stands in 2026: hybrid key exchange (X25519MLKEM768) is shipping, PQ signatures are the open problem, and Merkle Tree Certificates are the emerging answer.

• Fix "This Connection Is Not Private" in Safari (Mac & iPhone)

  Safari's 'This Connection Is Not Private' warning, explained. What it means on Mac and iPhone, whether it's safe to continue, and the fastest way to fix it.

• One Certificate Inventory for the Five CAs You Actually Use

  Mid-size orgs have certs from 5-10 sources: Let's Encrypt, AWS ACM, Cloudflare, DigiCert, internal CA, vendor portals. Five dashboards is zero coverage. What consolidation actually requires.

• Fix "Warning: Potential Security Risk Ahead" in Firefox

  Firefox's triangle warning explained. Map each SEC_ERROR_* / SSL_ERROR_* / MOZILLA_PKIX_* code to its cause and fix.

• Quantum Computers and Your Website's Security: A Plain-English Guide

  Will quantum computers break your website's encryption? A plain-English, no-hype guide to post-quantum cryptography, harvest-now-decrypt-later, and what a regular site owner should actually do.

• Fix "Your Connection Is Not Private" in Chrome

  Chrome's red-shield warning explained. Map each NET::ERR_CERT_* error code to its cause and fix - including the distrusted-legacy-root cause behind most current AUTHORITY_INVALID errors, and the separate risk of CA-side compliance revocations.

• Anatomy of a TLS Outage: 5 Famous Incidents and What We Learned

  When a plane crashes, the industry doesn't quietly file the wreckage. It convenes investigators, builds a report, and circulates the findings so the same crash doesn't happen again. The crashes still

• PCI-DSS 4.0 TLS Requirements, Explained Like You're Busy

  Think of PCI-DSS as the health inspection your restaurant takes every year, except the restaurant is your business and the food is your customers' credit card data. The inspector has a checklist. You

• The 47-Day Certificate Schedule: SC-081v3, DCV Reuse, and What to Automate

  CA/Browser Forum ballot SC-081v3 cuts certificate validity to 47 days and domain-validation reuse to 10 days by 2029. The full schedule and what it does to your renewal and validation pipeline.

• Benefits of SSL Certificate Monitoring (And Why You Need It)

  Seven concrete benefits of continuous SSL certificate monitoring - outage prevention, silent-failure detection, compliance evidence, inventory accuracy, and more.

• You Probably Have 2-3x More Certificates Than You Think

  Most teams underestimate certificate count by 2-3x. Five common sources of shadow certs and the discovery exercise that closes the gap.

• How to Renew an Expired SSL Certificate

  All the common renewal paths - Let's Encrypt with certbot, commercial CAs like DigiCert and Sectigo, and managed cloud platforms - plus how to install and verify the renewed certificate.

• Shorter SSL Certificate Lifetimes: What the 2026-2029 Changes Mean for You

  SSL certificate lifetimes are shrinking - 200 days now, 100 in 2027, 47 by 2029. What the CA/Browser Forum's changes mean for you, and why more renewals means more chances to miss one.

• What Happens When Your SSL Certificate Expires?

  An expired SSL certificate triggers browser warnings, kills conversions, costs SEO, creates compliance exposure, and burns engineering time. Here's what each cost actually looks like.

• Why Expiry Monitoring Alone Isn't Enough

  Expiry monitoring catches one failure mode. Chain breaks, weak ciphers, hostname mismatches, and revocation all break TLS without changing the expiry date. What real SSL certificate monitoring should cover.

• Keyfactor Alternatives for Smaller Teams

  Hiring a general contractor to put up a single shelf is fine, if you have the budget. They will show up with three people, a plan, a timeline, a quote with line items, and a final invoice that include

• TLS Scan Report, Check by Check: A Technical Walkthrough

  A check-by-check technical walkthrough of a TLS scan report - grade methodology, hostname/SAN, chain, protocols, ciphers, and vulnerabilities - each with the openssl command to reproduce it.

• How to Check Your SSL Certificate's Expiration Date

  Four ways to check when your SSL certificate expires (or has already expired) - from a single shell command to continuous monitoring that catches every certificate across your domains.

• Internal Monitoring Sees Your Origin. External Monitoring Sees What Your Customer Sees.

  The TLS handshake is path-dependent. Why internal monitoring misses CDN-side issues, regional differences, OCSP failures, and cert pinning breaks - and what external validation actually requires.

• How to Fix an SSL Certificate Outage: A Step-by-Step Guide

  Diagnose and fix an SSL/TLS outage fast - then reduce the odds of the next one. Identify the failure category (expired, chain, hostname, cipher, untrusted), apply the right fix, and run a useful post-mortem.

• How to Read Your SSL Scan Report (Without Being a Security Expert)

  Got an SSL scan report and not sure what the grade, issues, and certificate details mean? A plain-English guide to reading every part of the report and knowing what to fix first.

• My SSL Certificate Expired - How to Fix It ASAP

  Your SSL certificate expired and the site is showing browser warnings? Here's exactly what to do: confirm it has expired, get a working certificate back up fast, install, verify, and prevent the next one.

• The 90-Day Certificate Era: What Actually Changes

  TLS certificate lifetimes are dropping to 200 days (2026), 100 (2027), and 47 (2029). What actually changes at small and large scale when renewals go from yearly to eight times a year - and what a team that's ready looks like.

• I don't want to learn what PKI, CA, ACME, EKU stand for, I only want a working certificate for my website

  You do not need to learn PKI, ACME, or CA jargon to get a working SSL certificate. Get one free in minutes, and let independent monitoring keep it working.

• Venafi Alternatives: When the Enterprise Tool Is Overkill

  Buying Venafi for a small team is a bit like buying a commercial-grade espresso machine for a kitchen that makes coffee twice a day. The machine is excellent. It will outlive you. It will also occupy

• Manage Your SSL Certificates by Just Asking Claude

  Check any site's SSL certificate, get a free new one, and get warned before yours expires - all by asking Claude in plain English. No dashboards, no API keys, no security expertise.

• PKI Isn't Your Product

  Post-quantum migration, 47-day validity, DCV method churn, ecosystem distrust events. That's the PKI work your team should be doing. Renewal monitoring isn't.

• NET::ERR_CERT_AUTHORITY_INVALID in Chrome and Brave: The Real Causes in 2026

  Two reasons Chrome and Brave throw NET::ERR_CERT_AUTHORITY_INVALID: distrusted legacy roots (SSL.com 2016, DigiCert G1, Entrust) - the live, current cause - and CA-side compliance revocations, illustrated by a mid-sized CA's forced revocation of 63,525 certificates in July 2026. CA-agnostic diagnostics and fix steps.

• SSL/TLS in Your Terminal: The TLS Radar Claude Code Plugin

  Scan certificates, issue free Let's Encrypt certs via Beacon, and set up monitoring without leaving Claude Code. Open source, OAuth-based, no API keys - here's the full command reference.

• Managing Thousands of TLS Certificates: A Practical Framework

  Once you pass a few hundred TLS certificates, managing them becomes its own discipline. A practical framework for inventory, ownership, renewals, and the silent failures that have nothing to do with expiry.

• DigiCert CertCentral Alternatives: An Honest Comparison

  Asking your certificate authority whether you need certificate monitoring is a bit like asking your barber whether you need a haircut. They will have an opinion. It will be sincere. It will also, myst

• The True Cost of a TLS Outage (And Why Calendars Won't Save You)

  Imagine you own a bakery. You wake up one morning, walk to the shop, and find that the front door has changed its own lock overnight. Nobody told it to. It just decided. Your key - the one you've used

• Valid SSL Certificate, but Chrome Says 'Not Secure'? Here's Why

  Your SSL certificate works in Firefox and Safari but Chrome and Brave throw NET::ERR_CERT_AUTHORITY_INVALID? The real cause is almost always a distrusted legacy root - plus a separate, growing risk of CA-side compliance revocations. What to ask your CA to reissue.

• How to Set Up SSL Certificate Alerts (Email, Slack, Webhooks)

  A short tutorial on configuring SSL certificate expiration alerts that actually get noticed - email, Slack, and webhooks compared.

• Let's Encrypt vs Paid SSL Certificates: Which One Should You Use?

  A clear, practical comparison of Let's Encrypt and paid SSL certificates - what each one is best at, where they fall short, and how to choose.

• How to Prevent SSL Certificate Expiration Downtime

  A practical guide to setting up alerts, automation, and monitoring so your certificates never expire unexpectedly.

• What Is SSL/TLS Certificate Monitoring and Why Does It Matter?

  Learn why automated SSL/TLS certificate monitoring is essential for preventing outages, maintaining security, and staying compliant.