LogJam (CVE-2015-4000)
Imagine a combination lock with only three digits. It does its job in the sense that there is a locking mechanism. It clicks shut. The dial turns. From a distance, it's a lock. Up close, a determined
Tagged “ssl”
Post-Mortem Patterns: Why TLS Outages Are Always "Surprising
You don't usually discover a roof leak in the middle of a sunny afternoon. You discover it during the storm - water dripping onto the kitchen counter, a brown stain spreading across the ceiling. The l
TLS 1.0 and 1.1: Why They're Still Running and How to Find Them
In the back office of an otherwise modern company, there is often a fax machine. It is plugged in. It is occasionally used. There is exactly one customer - a hospital, a court, a regulator, an insuran
The Compliance Calendar: TLS Tasks by Framework, by Quarter
A gardener knows the calendar. Spring is for planting. Summer is for watering and deadheading. Autumn is for pruning and clearing leaves. Winter is for the long, slow jobs - mulching, planning, orderi
Sectigo Certificate Manager Alternatives
A lot of people have the same phone plan they got at university. Not because it's the best plan. Not because they've shopped around. Because switching feels like work, the bill is auto-paid, and on mo
Cert Monitoring vs. Cert Management: Pick the Right Hammer
Cert monitoring, lifecycle management, issuance, and discovery are four different categories that vendor marketing blurs together. What each one does, why they aren't interchangeable, and a practical diagnostic for which you actually need.
PCI-DSS for E-commerce: TLS Requirements That Actually Matter
A jewelry store with a window display has a particular kind of security problem. The display has to look good - that's the point. It has to be visible from the street. It has to invite people in. It a
Eight eMudhra Intermediate Certificates Were Compromised. What It Means for Your Site
Mozilla disclosed that the private keys of eight eMudhra intermediate certificates were compromised. Firefox blocked them within three hours, and eMudhra and Sectigo revoked all 16 copies. Which certificates are affected, why it matters even if you never used eMudhra, and what to check.
GoDaddy Is Revoking 404,607 Certificates Because They Don't Match Its Own Rulebook
GoDaddy is revoking 404,607 TLS certificates because the policy lines inside them don't match its own published rulebook, and it has missed the five-day deadline. What went wrong, which certificates are affected, and what to do before yours is revoked.
The Hidden Outage: When Your Cert is Valid But Your Site Still Breaks
Imagine a small restaurant. The door is unlocked. The lights are on. The kitchen is running. The food is fine. But a "Closed" sign is still hanging in the window from last Tuesday's day off, and nobod
Hostname Mismatch and SAN Sprawl
At a private wedding, the bouncer has a list. Names of approved guests. They check each arrival against the list. If your name's on it, you're in. If it isn't, you're not, even if you're standing next
Your Certificate Will Get Revoked if It Started More Than 48 Hours Before Actual Issuance
If your certificate's start date is more than 48 hours before it was actually issued, industry rules call that backdated, and your CA has 5 days to revoke it once it finds out. Nothing is wrong on your end. Here's what backdating means, a real 2026 example, and what TLS Radar checks for it.
Building Audit-Ready TLS Evidence (Free Template)
When you travel internationally, the careful traveller keeps a folder. Not metaphorically - a literal folder, or a phone wallet, or a screenshot album. In it: a copy of the passport, the visa, hotel c
BEAST Attack (Browser Exploit Against SSL/TLS)
Imagine standing behind someone at an ATM. They type their PIN. You can't see the screen, but you can see their finger movements - which row of the keypad they hover over before pressing. Combined wit
What Is a Dual-Use Certificate, and How to Know if Chrome Will Reject My Certificate on March 15, 2027
A dual-use certificate lists both server and client authentication in the same certificate. Chrome's root program rejects one issued on or after March 15, 2027. Here's what the two settings mean, how to check your own certificate in one command, and what over 118 million already-issued certificates mean for you.
Multi-Cloud Certificate Inventory: Why It's Harder Than It Looks
Imagine you've stored your possessions across three garages owned by three different friends. The friend with the suburban house. The friend with the city flat. The friend with the holiday cabin. You
How to Find Out if My Certificate Was Revoked?
Revocation doesn't change your certificate file, so you can't tell by looking at it. Here's how revocation checking actually works, why a one-off check is only a snapshot, and what it means when even the check itself is broken.
AppViewX Alternatives: When You Need Monitoring, Not Lifecycle Management
Imagine buying a programmable industrial sewing machine - the kind that does intricate embroidery, runs custom patterns, and integrates with a CAD system - when all you actually need is a button reatt
Browsers Stopped Trusting Your Valid Certificate Because an Intermediate Certificate Was Revoked by Your CA Vendor
Your certificate can be valid and correct, and browsers will still stop trusting it if your CA revokes the intermediate certificate behind it. Four CAs missed a hard revocation deadline in September 2026. Here's what that means for your site, and what TLS Radar now checks for it.
What an Expired Certificate Actually Does to Your Conversion Rate
A restaurant with a public health notice taped to its door is still, technically, a restaurant. The food might be fine. The chef might be excellent. The seasonal menu might be the best in the city. Bu
Chain Validation Pitfalls (And Why Cross-Signing Bites)
When you write a letter of recommendation, the letter only works if the recipient recognises the recommender. A letter from Dr. Smith means something to the admissions committee that knows Dr. Smith.
ISO 27001 Annex A.10 (and A.8.24), Mapped to Certificate Controls
At school, the best maths teachers had a rule: "show your work." Getting the right answer wasn't enough. You had to show - step by step, line by line - how you got there. The point wasn't to be pedant
ROBOT Attack (Return Of Bleichenbacher's Oracle Threat)
Imagine a safe with a slightly badly designed combination keypad. When you enter the wrong combination, the safe doesn't just say "wrong." It says - by the sound of the latch, the speed of the locking
Inheriting a PKI Mess: The First 90 Days
When you buy an old house, you don't just inherit the walls. You inherit the previous owner's accumulated decisions. The wallpaper they chose in 1997. The boiler they replaced in 2014 with the cheapes
SSL.com Revoked 2,700 Certificates in 24 Hours After an Audit Found a Missing Check
An annual WebTrust audit found four sampled certificates with no evidence that multi-perspective domain validation was performed. The full investigation found 2,700, and SSL.com revoked them all within a day. What MPIC is, why you could not have seen this one coming, the second SSL.com incident you can check for yourself, and what TLS Radar's new revocation checking does about it.
DigiCert vs Venafi: An Honest Comparison
When your car needs servicing, you have two reasonable options. You can take it to the dealership where you bought it. They specialise in cars of that brand. They have the tools, the parts, and the se
Your Certificate's Country and State Fields Might Not Agree. CAs Have Revoked Certs For This.
TLS Radar now checks whether a certificate's country code and state/province are internally consistent - the exact class of error that got GlobalSign and Sectigo forced into mass revocations. Runs on every scan, free or full.
The Cert Renewal Game of Telephone: When Ownership Falls Through the Cracks
When you played telephone as a kid, the rules were simple. Someone whispers a sentence into the first person's ear. That person whispers what they heard to the next person. By the time the message rea
Certificate Revocation in 2026: CRL, OCSP, CRLite, and What's Coming
How TLS certificate revocation works in 2026 - CRL, OCSP, OCSP stapling, and browser-pushed lists like CRLite - what's broken about it, why OCSP is winding down, and what your team should actually do about it.
HIPAA + TLS: The Certificate Compliance Angle
When you write something on a postcard, anyone who handles it can read it. The postman. The sorter. The person who picks it out of the mailbox. The neighbour who happened to be in the lobby. The postc
Keychest Alternatives: When You Outgrow It
When you first move out, the studio apartment is great. It is exactly the right size. The rent is manageable. You can clean the whole place in twenty minutes. You can shout from the kitchen to the fro
ACME at Enterprise Scale: Pitfalls and Patterns
A revolving door is a small, elegant piece of engineering. It controls the flow of people. It keeps heat in. It looks nice. At a small office building, it works perfectly - twenty or thirty people pas
Heartbleed (CVE-2014-0160)
Imagine paying for a coffee at a café. You give the cashier a £5 note. They give you £3.50 in change, plus - because they're not paying attention - a small handful of receipts, business cards, and wha
The 3am Cert Expiry: Why Outages Always Happen at the Worst Time
The car never breaks down in the driveway.
Build vs. Buy: In-House TLS Monitoring at Enterprise Scale
Some people roast their own coffee. They buy green beans, weigh them out, use a small drum roaster, time the first crack, listen for the second crack, cool the beans, rest them, grind them fresh, and
TLS and SSL Errors Explained (Every Browser, Every Code)
Every TLS/SSL error - NET::ERR_CERT_*, SEC_ERROR_*, Safari's plain-English warnings, curl's cert errors - collapses into six root causes. What each one means, which browsers use which codes for it, and how to diagnose your own certificate in 30 seconds.
The Post-Quantum TLS Migration Playbook for Enterprises
A homeowner in a coastal region doesn't wait until the storm is on top of them to put up shutters. They watch the forecast. When a serious hurricane is named - even if it's still days out, still uncer
Red Sift Certificates Alternatives
Buying Red Sift Certificates because you need cert monitoring is a bit like buying a Swiss Army knife because you need a screwdriver. The screwdriver is in there. It's a fine screwdriver. You will als
What 'Your Connection Is Not Private' Actually Costs You
Browser certificate warnings have a ~90% bounce rate. Worked numbers on direct revenue loss, SEO recovery, trust decay, and the structural fix.
Building a TLS Incident Runbook (Free Template)
The time to plan a fire drill is not during a fire.
Weak Cipher Suites Still Running in Production
Most gym lockers have a padlock. The padlock clicks shut. It looks secure. To anyone glancing at it, the locker is locked. To anyone with a YouTube video and ninety seconds, it isn't.
Fix Browser Security Warnings in Microsoft Edge
Microsoft Edge inherits Chromium's TLS validation, including which CA roots it trusts, and uses the Windows certificate trust store. Map each error to its fix, with attention to Windows-specific trust store and Group Policy specifics.
Fix Browser Security Warnings in Brave
Brave inherits Chromium's TLS validation, including which CA roots it trusts. Map each NET::ERR_CERT_* error code to its cause and fix, plus a few Brave-specific gotchas (Shields, Tor windows).
SOC 2 and TLS: What Auditors Actually Check
A SOC 2 audit is not like going to the dentist. The dentist has a known procedure. They clean your teeth, count them, look for cavities, and send you home with a small toothbrush. The visit fits in a
The Certificate Inventory Problem (And Why Yours Is Wrong)
Open your garage. Now name everything in it. Not "boxes, bikes, the lawnmower." Specifically: what's in the boxes? How many bikes? Whose tools are in the cabinet you haven't opened since 2022?
Fix "This Connection Is Not Private" in Safari (Mac & iPhone)
Safari's 'This Connection Is Not Private' warning, explained. What it means on Mac and iPhone, whether it's safe to continue, and the fastest way to fix it.
Fix "Warning: Potential Security Risk Ahead" in Firefox
Firefox's triangle warning explained. Map each SEC_ERROR_* / SSL_ERROR_* / MOZILLA_PKIX_* code to its cause and fix.
Fix "Your Connection Is Not Private" in Chrome
Chrome's red-shield warning explained. Map each NET::ERR_CERT_* error code to its cause and fix - including the distrusted-legacy-root cause behind most current AUTHORITY_INVALID errors, and the separate risk of CA-side compliance revocations.
Anatomy of a TLS Outage: 5 Famous Incidents and What We Learned
When a plane crashes, the industry doesn't quietly file the wreckage. It convenes investigators, builds a report, and circulates the findings so the same crash doesn't happen again. The crashes still
PCI-DSS 4.0 TLS Requirements, Explained Like You're Busy
Think of PCI-DSS as the health inspection your restaurant takes every year, except the restaurant is your business and the food is your customers' credit card data. The inspector has a checklist. You
Benefits of SSL Certificate Monitoring (And Why You Need It)
Seven concrete benefits of continuous SSL certificate monitoring - outage prevention, silent-failure detection, compliance evidence, inventory accuracy, and more.
How to Renew an Expired SSL Certificate
All the common renewal paths - Let's Encrypt with certbot, commercial CAs like DigiCert and Sectigo, and managed cloud platforms - plus how to install and verify the renewed certificate.
Shorter SSL Certificate Lifetimes: What the 2026-2029 Changes Mean for You
SSL certificate lifetimes are shrinking - 200 days now, 100 in 2027, 47 by 2029. What the CA/Browser Forum's changes mean for you, and why more renewals means more chances to miss one.
What Happens When Your SSL Certificate Expires?
An expired SSL certificate triggers browser warnings, kills conversions, costs SEO, creates compliance exposure, and burns engineering time. Here's what each cost actually looks like.
Why Expiry Monitoring Alone Isn't Enough
Expiry monitoring catches one failure mode. Chain breaks, weak ciphers, hostname mismatches, and revocation all break TLS without changing the expiry date. What real SSL certificate monitoring should cover.
Keyfactor Alternatives for Smaller Teams
Hiring a general contractor to put up a single shelf is fine, if you have the budget. They will show up with three people, a plan, a timeline, a quote with line items, and a final invoice that include
How to Check Your SSL Certificate's Expiration Date
Four ways to check when your SSL certificate expires (or has already expired) - from a single shell command to continuous monitoring that catches every certificate across your domains.
How to Fix an SSL Certificate Outage: A Step-by-Step Guide
Diagnose and fix an SSL/TLS outage fast - then reduce the odds of the next one. Identify the failure category (expired, chain, hostname, cipher, untrusted), apply the right fix, and run a useful post-mortem.
How to Read Your SSL Scan Report (Without Being a Security Expert)
Got an SSL scan report and not sure what the grade, issues, and certificate details mean? A plain-English guide to reading every part of the report and knowing what to fix first.
My SSL Certificate Expired - How to Fix It ASAP
Your SSL certificate expired and the site is showing browser warnings? Here's exactly what to do: confirm it has expired, get a working certificate back up fast, install, verify, and prevent the next one.
The 90-Day Certificate Era: What Actually Changes
TLS certificate lifetimes are dropping to 200 days (2026), 100 (2027), and 47 (2029). What actually changes at small and large scale when renewals go from yearly to eight times a year - and what a team that's ready looks like.
I don't want to learn what PKI, CA, ACME, EKU stand for, I only want a working certificate for my website
You do not need to learn PKI, ACME, or CA jargon to get a working SSL certificate. Get one free in minutes, and let independent monitoring keep it working.
Venafi Alternatives: When the Enterprise Tool Is Overkill
Buying Venafi for a small team is a bit like buying a commercial-grade espresso machine for a kitchen that makes coffee twice a day. The machine is excellent. It will outlive you. It will also occupy
Manage Your SSL Certificates by Just Asking Claude
Check any site's SSL certificate, get a free new one, and get warned before yours expires - all by asking Claude in plain English. No dashboards, no API keys, no security expertise.
SSL/TLS in Your Terminal: The TLS Radar Claude Code Plugin
Scan certificates, issue free Let's Encrypt certs via Beacon, and set up monitoring without leaving Claude Code. Open source, OAuth-based, no API keys - here's the full command reference.
Managing Thousands of TLS Certificates: A Practical Framework
Once you pass a few hundred TLS certificates, managing them becomes its own discipline. A practical framework for inventory, ownership, renewals, and the silent failures that have nothing to do with expiry.
DigiCert CertCentral Alternatives: An Honest Comparison
Asking your certificate authority whether you need certificate monitoring is a bit like asking your barber whether you need a haircut. They will have an opinion. It will be sincere. It will also, myst
The True Cost of a TLS Outage (And Why Calendars Won't Save You)
Imagine you own a bakery. You wake up one morning, walk to the shop, and find that the front door has changed its own lock overnight. Nobody told it to. It just decided. Your key - the one you've used
Valid SSL Certificate, but Chrome Says 'Not Secure'? Here's Why
Your SSL certificate works in Firefox and Safari but Chrome and Brave throw NET::ERR_CERT_AUTHORITY_INVALID? The real cause is almost always a distrusted legacy root - plus a separate, growing risk of CA-side compliance revocations. What to ask your CA to reissue.
SSL Certificate Outages - 4 Real Incidents and What They Teach Us
Four real-world certificate outages from major companies, in plain English. What broke, how it broke, and the simple monitoring step that would have caught it.
How to Set Up SSL Certificate Alerts (Email, Slack, Webhooks)
A short tutorial on configuring SSL certificate expiration alerts that actually get noticed - email, Slack, and webhooks compared.
Let's Encrypt vs Paid SSL Certificates: Which One Should You Use?
A clear, practical comparison of Let's Encrypt and paid SSL certificates - what each one is best at, where they fall short, and how to choose.
How to Prevent SSL Certificate Expiration Downtime
A practical guide to setting up alerts, automation, and monitoring so your certificates never expire unexpectedly.
What Is SSL/TLS Certificate Monitoring and Why Does It Matter?
Learn why automated SSL/TLS certificate monitoring is essential for preventing outages, maintaining security, and staying compliant.
Subscribe via RSS.