If your certificate's start date is more than 48 hours before it was actually issued, industry rules call that backdated, and your CA has 5 days to revoke it once it finds out. Nothing is wrong on your end. Here's what backdating means, a real 2026 example, and what TLS Radar checks for it.
A dual-use certificate lists both server and client authentication in the same certificate. Chrome's root program rejects one issued on or after March 15, 2027. Here's what the two settings mean, how to check your own certificate in one command, and what over 118 million already-issued certificates mean for you.
Revocation doesn't change your certificate file, so you can't tell by looking at it. Here's how revocation checking actually works, why a one-off check is only a snapshot, and what it means when even the check itself is broken.
Your certificate can be valid and correct, and browsers will still stop trusting it if your CA revokes the intermediate certificate behind it. Four CAs missed a hard revocation deadline in September 2026. Here's what that means for your site, and what TLS Radar now checks for it.
TLS Radar now checks whether a certificate's country code and state/province are internally consistent - the exact class of error that got GlobalSign and Sectigo forced into mass revocations. Runs on every scan, free or full.
A check-by-check technical walkthrough of a TLS scan report - grade methodology, hostname/SAN, chain, protocols, ciphers, and vulnerabilities - each with the openssl command to reproduce it.
Got an SSL scan report and not sure what the grade, issues, and certificate details mean? A plain-English guide to reading every part of the report and knowing what to fix first.
Subscribe via RSS.