LogJam (CVE-2015-4000)
Imagine a combination lock with only three digits. It does its job in the sense that there is a locking mechanism. It clicks shut. The dial turns. From a distance, it's a lock. Up close, a determined
Tagged “tls”
Post-Mortem Patterns: Why TLS Outages Are Always "Surprising
You don't usually discover a roof leak in the middle of a sunny afternoon. You discover it during the storm - water dripping onto the kitchen counter, a brown stain spreading across the ceiling. The l
TLS 1.0 and 1.1: Why They're Still Running and How to Find Them
In the back office of an otherwise modern company, there is often a fax machine. It is plugged in. It is occasionally used. There is exactly one customer - a hospital, a court, a regulator, an insuran
The Compliance Calendar: TLS Tasks by Framework, by Quarter
A gardener knows the calendar. Spring is for planting. Summer is for watering and deadheading. Autumn is for pruning and clearing leaves. Winter is for the long, slow jobs - mulching, planning, orderi
Sectigo Certificate Manager Alternatives
A lot of people have the same phone plan they got at university. Not because it's the best plan. Not because they've shopped around. Because switching feels like work, the bill is auto-paid, and on mo
Cert Monitoring vs. Cert Management: Pick the Right Hammer
Cert monitoring, lifecycle management, issuance, and discovery are four different categories that vendor marketing blurs together. What each one does, why they aren't interchangeable, and a practical diagnostic for which you actually need.
PCI-DSS for E-commerce: TLS Requirements That Actually Matter
A jewelry store with a window display has a particular kind of security problem. The display has to look good - that's the point. It has to be visible from the street. It has to invite people in. It a
Eight eMudhra Intermediate Certificates Were Compromised. What It Means for Your Site
Mozilla disclosed that the private keys of eight eMudhra intermediate certificates were compromised. Firefox blocked them within three hours, and eMudhra and Sectigo revoked all 16 copies. Which certificates are affected, why it matters even if you never used eMudhra, and what to check.
GoDaddy Is Revoking 404,607 Certificates Because They Don't Match Its Own Rulebook
GoDaddy is revoking 404,607 TLS certificates because the policy lines inside them don't match its own published rulebook, and it has missed the five-day deadline. What went wrong, which certificates are affected, and what to do before yours is revoked.
The Hidden Outage: When Your Cert is Valid But Your Site Still Breaks
Imagine a small restaurant. The door is unlocked. The lights are on. The kitchen is running. The food is fine. But a "Closed" sign is still hanging in the window from last Tuesday's day off, and nobod
Hostname Mismatch and SAN Sprawl
At a private wedding, the bouncer has a list. Names of approved guests. They check each arrival against the list. If your name's on it, you're in. If it isn't, you're not, even if you're standing next
Your Certificate Will Get Revoked if It Started More Than 48 Hours Before Actual Issuance
If your certificate's start date is more than 48 hours before it was actually issued, industry rules call that backdated, and your CA has 5 days to revoke it once it finds out. Nothing is wrong on your end. Here's what backdating means, a real 2026 example, and what TLS Radar checks for it.
Building Audit-Ready TLS Evidence (Free Template)
When you travel internationally, the careful traveller keeps a folder. Not metaphorically - a literal folder, or a phone wallet, or a screenshot album. In it: a copy of the passport, the visa, hotel c
BEAST Attack (Browser Exploit Against SSL/TLS)
Imagine standing behind someone at an ATM. They type their PIN. You can't see the screen, but you can see their finger movements - which row of the keypad they hover over before pressing. Combined wit
What Is a Dual-Use Certificate, and How to Know if Chrome Will Reject My Certificate on March 15, 2027
A dual-use certificate lists both server and client authentication in the same certificate. Chrome's root program rejects one issued on or after March 15, 2027. Here's what the two settings mean, how to check your own certificate in one command, and what over 118 million already-issued certificates mean for you.
Multi-Cloud Certificate Inventory: Why It's Harder Than It Looks
Imagine you've stored your possessions across three garages owned by three different friends. The friend with the suburban house. The friend with the city flat. The friend with the holiday cabin. You
How to Find Out if My Certificate Was Revoked?
Revocation doesn't change your certificate file, so you can't tell by looking at it. Here's how revocation checking actually works, why a one-off check is only a snapshot, and what it means when even the check itself is broken.
AppViewX Alternatives: When You Need Monitoring, Not Lifecycle Management
Imagine buying a programmable industrial sewing machine - the kind that does intricate embroidery, runs custom patterns, and integrates with a CAD system - when all you actually need is a button reatt
Browsers Stopped Trusting Your Valid Certificate Because an Intermediate Certificate Was Revoked by Your CA Vendor
Your certificate can be valid and correct, and browsers will still stop trusting it if your CA revokes the intermediate certificate behind it. Four CAs missed a hard revocation deadline in September 2026. Here's what that means for your site, and what TLS Radar now checks for it.
What an Expired Certificate Actually Does to Your Conversion Rate
A restaurant with a public health notice taped to its door is still, technically, a restaurant. The food might be fine. The chef might be excellent. The seasonal menu might be the best in the city. Bu
Chain Validation Pitfalls (And Why Cross-Signing Bites)
When you write a letter of recommendation, the letter only works if the recipient recognises the recommender. A letter from Dr. Smith means something to the admissions committee that knows Dr. Smith.
ISO 27001 Annex A.10 (and A.8.24), Mapped to Certificate Controls
At school, the best maths teachers had a rule: "show your work." Getting the right answer wasn't enough. You had to show - step by step, line by line - how you got there. The point wasn't to be pedant
ROBOT Attack (Return Of Bleichenbacher's Oracle Threat)
Imagine a safe with a slightly badly designed combination keypad. When you enter the wrong combination, the safe doesn't just say "wrong." It says - by the sound of the latch, the speed of the locking
Inheriting a PKI Mess: The First 90 Days
When you buy an old house, you don't just inherit the walls. You inherit the previous owner's accumulated decisions. The wallpaper they chose in 1997. The boiler they replaced in 2014 with the cheapes
SSL.com Revoked 2,700 Certificates in 24 Hours After an Audit Found a Missing Check
An annual WebTrust audit found four sampled certificates with no evidence that multi-perspective domain validation was performed. The full investigation found 2,700, and SSL.com revoked them all within a day. What MPIC is, why you could not have seen this one coming, the second SSL.com incident you can check for yourself, and what TLS Radar's new revocation checking does about it.
DigiCert vs Venafi: An Honest Comparison
When your car needs servicing, you have two reasonable options. You can take it to the dealership where you bought it. They specialise in cars of that brand. They have the tools, the parts, and the se
Your Certificate's Country and State Fields Might Not Agree. CAs Have Revoked Certs For This.
TLS Radar now checks whether a certificate's country code and state/province are internally consistent - the exact class of error that got GlobalSign and Sectigo forced into mass revocations. Runs on every scan, free or full.
The Cert Renewal Game of Telephone: When Ownership Falls Through the Cracks
When you played telephone as a kid, the rules were simple. Someone whispers a sentence into the first person's ear. That person whispers what they heard to the next person. By the time the message rea
Certificate Revocation in 2026: CRL, OCSP, CRLite, and What's Coming
How TLS certificate revocation works in 2026 - CRL, OCSP, OCSP stapling, and browser-pushed lists like CRLite - what's broken about it, why OCSP is winding down, and what your team should actually do about it.
HIPAA + TLS: The Certificate Compliance Angle
When you write something on a postcard, anyone who handles it can read it. The postman. The sorter. The person who picks it out of the mailbox. The neighbour who happened to be in the lobby. The postc
Keychest Alternatives: When You Outgrow It
When you first move out, the studio apartment is great. It is exactly the right size. The rent is manageable. You can clean the whole place in twenty minutes. You can shout from the kitchen to the fro
ACME at Enterprise Scale: Pitfalls and Patterns
A revolving door is a small, elegant piece of engineering. It controls the flow of people. It keeps heat in. It looks nice. At a small office building, it works perfectly - twenty or thirty people pas
Heartbleed (CVE-2014-0160)
Imagine paying for a coffee at a café. You give the cashier a £5 note. They give you £3.50 in change, plus - because they're not paying attention - a small handful of receipts, business cards, and wha
The 3am Cert Expiry: Why Outages Always Happen at the Worst Time
The car never breaks down in the driveway.
Build vs. Buy: In-House TLS Monitoring at Enterprise Scale
Some people roast their own coffee. They buy green beans, weigh them out, use a small drum roaster, time the first crack, listen for the second crack, cool the beans, rest them, grind them fresh, and
TLS and SSL Errors Explained (Every Browser, Every Code)
Every TLS/SSL error - NET::ERR_CERT_*, SEC_ERROR_*, Safari's plain-English warnings, curl's cert errors - collapses into six root causes. What each one means, which browsers use which codes for it, and how to diagnose your own certificate in 30 seconds.
The Post-Quantum TLS Migration Playbook for Enterprises
A homeowner in a coastal region doesn't wait until the storm is on top of them to put up shutters. They watch the forecast. When a serious hurricane is named - even if it's still days out, still uncer
Red Sift Certificates Alternatives
Buying Red Sift Certificates because you need cert monitoring is a bit like buying a Swiss Army knife because you need a screwdriver. The screwdriver is in there. It's a fine screwdriver. You will als
Building a TLS Incident Runbook (Free Template)
The time to plan a fire drill is not during a fire.
Weak Cipher Suites Still Running in Production
Most gym lockers have a padlock. The padlock clicks shut. It looks secure. To anyone glancing at it, the locker is locked. To anyone with a YouTube video and ninety seconds, it isn't.
SOC 2 and TLS: What Auditors Actually Check
A SOC 2 audit is not like going to the dentist. The dentist has a known procedure. They clean your teeth, count them, look for cavities, and send you home with a small toothbrush. The visit fits in a
The Certificate Inventory Problem (And Why Yours Is Wrong)
Open your garage. Now name everything in it. Not "boxes, bikes, the lawnmower." Specifically: what's in the boxes? How many bikes? Whose tools are in the cabinet you haven't opened since 2022?
Post-Quantum TLS in 2026: What's Deployed, and the Certificate Problem
Where post-quantum TLS actually stands in 2026: hybrid key exchange (X25519MLKEM768) is shipping, PQ signatures are the open problem, and Merkle Tree Certificates are the emerging answer.
Anatomy of a TLS Outage: 5 Famous Incidents and What We Learned
When a plane crashes, the industry doesn't quietly file the wreckage. It convenes investigators, builds a report, and circulates the findings so the same crash doesn't happen again. The crashes still
PCI-DSS 4.0 TLS Requirements, Explained Like You're Busy
Think of PCI-DSS as the health inspection your restaurant takes every year, except the restaurant is your business and the food is your customers' credit card data. The inspector has a checklist. You
The 47-Day Certificate Schedule: SC-081v3, DCV Reuse, and What to Automate
CA/Browser Forum ballot SC-081v3 cuts certificate validity to 47 days and domain-validation reuse to 10 days by 2029. The full schedule and what it does to your renewal and validation pipeline.
Shorter SSL Certificate Lifetimes: What the 2026-2029 Changes Mean for You
SSL certificate lifetimes are shrinking - 200 days now, 100 in 2027, 47 by 2029. What the CA/Browser Forum's changes mean for you, and why more renewals means more chances to miss one.
Why Expiry Monitoring Alone Isn't Enough
Expiry monitoring catches one failure mode. Chain breaks, weak ciphers, hostname mismatches, and revocation all break TLS without changing the expiry date. What real SSL certificate monitoring should cover.
Keyfactor Alternatives for Smaller Teams
Hiring a general contractor to put up a single shelf is fine, if you have the budget. They will show up with three people, a plan, a timeline, a quote with line items, and a final invoice that include
TLS Scan Report, Check by Check: A Technical Walkthrough
A check-by-check technical walkthrough of a TLS scan report - grade methodology, hostname/SAN, chain, protocols, ciphers, and vulnerabilities - each with the openssl command to reproduce it.
The 90-Day Certificate Era: What Actually Changes
TLS certificate lifetimes are dropping to 200 days (2026), 100 (2027), and 47 (2029). What actually changes at small and large scale when renewals go from yearly to eight times a year - and what a team that's ready looks like.
I don't want to learn what PKI, CA, ACME, EKU stand for, I only want a working certificate for my website
You do not need to learn PKI, ACME, or CA jargon to get a working SSL certificate. Get one free in minutes, and let independent monitoring keep it working.
Venafi Alternatives: When the Enterprise Tool Is Overkill
Buying Venafi for a small team is a bit like buying a commercial-grade espresso machine for a kitchen that makes coffee twice a day. The machine is excellent. It will outlive you. It will also occupy
Managing Thousands of TLS Certificates: A Practical Framework
Once you pass a few hundred TLS certificates, managing them becomes its own discipline. A practical framework for inventory, ownership, renewals, and the silent failures that have nothing to do with expiry.
DigiCert CertCentral Alternatives: An Honest Comparison
Asking your certificate authority whether you need certificate monitoring is a bit like asking your barber whether you need a haircut. They will have an opinion. It will be sincere. It will also, myst
The True Cost of a TLS Outage (And Why Calendars Won't Save You)
Imagine you own a bakery. You wake up one morning, walk to the shop, and find that the front door has changed its own lock overnight. Nobody told it to. It just decided. Your key - the one you've used
Valid SSL Certificate, but Chrome Says 'Not Secure'? Here's Why
Your SSL certificate works in Firefox and Safari but Chrome and Brave throw NET::ERR_CERT_AUTHORITY_INVALID? The real cause is almost always a distrusted legacy root - plus a separate, growing risk of CA-side compliance revocations. What to ask your CA to reissue.
What Is SSL/TLS Certificate Monitoring and Why Does It Matter?
Learn why automated SSL/TLS certificate monitoring is essential for preventing outages, maintaining security, and staying compliant.
Subscribe via RSS.