The cybersecurity crowd loves to pitch certificate automation as some sleek, forward-thinking upgrade for the modern web. But let’s be real: we didn’t get here because everyone suddenly became proactive. We got here because the industry kept messing up. Automation isn’t a reward for good behavior; it’s an intervention. For years,we’ve seen a spectacular parade […]
Certificate automation is a solved problem. The tools exist, the CAs support them, and most IT teams understand the risk of going manual. Yet 38% of organizations still manage certificates with spreadsheets, and 70% admit they don’t have the staff to keep up. The gap between what’s available and what’s adopted isn’t a technical story. […]
The SSL industry already has one countdown on the wall. By 2029, the old annual renewal rhythm will be gone. Certificates will expire faster, automation will be mandatory, and businesses still running on calendar reminders will fall behind. That challenge, at least, is legible. The harder problem is not about time. It’s about visibility. Post-quantum […]
On May 8, 2026, Let’s Encrypt temporarily stopped issuing certificates after detecting an internal error in its certificate system. Existing certificates remained valid, but new requests and automated renewals were affected during the interruption. Service was later restored after Let’s Encrypt changed the affected issuance path. What Happened Inside Let’s Encrypt? The interruption traced back […]
If SSL certificates were only about encryption, the paid market should have collapsed by now. Basic HTTPS is everywhere. Free DV certificates protect ordinary websites. Hosting panels turn SSL into a checkbox. Browsers no longer treat encrypted pages as special; they flag unencrypted ones as broken. Yet paid SSL still exists. The market thrives because […]
Picking a code signing certificate provider is harder than it should be. Four publicly-trusted Certificate Authorities cover almost every legitimate buying scenario: Sectigo, Comodo, DigiCert, and GoGetSSL. At first glance they all look similar. They issue the same X.509 certificates, follow the same CA/Browser Forum rules, and ship hardware tokens that meet the same FIPS […]
SSL certificate validity is changing, and the shift has already started. The industry is moving away from long-lived certificates and toward much shorter lifetimes, forcing a different approach to how you manage SSL/TLS. This is not a minor update. Reduced SSL validity increases the frequency at which you issue certificates, validate domains, and handle renewals. […]
SSL certificates are often treated as a set-and-forget layer of infrastructure. Once installed, browsers stay quiet, and encryption fades into the background. From a support perspective, reality looks very different. Behind routine installations sits a steady flow of tickets where certificates are technically valid, correctly deployed, and still failing in ways that aren’t immediately visible. […]
You’ve just received your SSL certificate files and notice two extensions: .crt and .cer. Your server expects one, your certificate authority (CA) sent the other. Before you start troubleshooting, here’s the short answer: both file extensions hold the same X.509 certificate data, and the difference is mostly a naming convention. But “mostly” is doing some […]
At SSL Dragon, we work with SSL certificates across a wide range of environments, from simple single-domain sites to modern stacks where TLS is deliberately spread across multiple layers. Over time, that range makes one thing clear: TLS itself is stable, but the way it’s understood hasn’t kept pace with its evolution. Today, HTTPS commonly […]
ERR_SSL_VERSION_OR_CIPHER_MISMATCH is the message Chrome shows when it cannot agree on encryption terms with a website. The handshake ends before any page content is sent, so there is nothing to display and no option to continue anyway. You may also encounter variations of this error: That second line is not a paraphrase. It is the […]
A modulus mismatch means your SSL certificate and your private key are not a matching pair. The certificate was issued for one key, and the file your server is loading is a different key. Because a TLS server has to prove it holds the private key belonging to the certificate it presents, there is nothing […]
When Chrome blocks a page with NET::ERR_CERT_AUTHORITY_INVALID, it is saying something narrower than “the certificate is bad”. The certificate may be perfectly valid: issued by a real Certificate Authority, matching the domain, and still well inside its validity period. What failed is the chain. Chrome could not link that certificate back to a root certificate […]
NET::ERR_CERT_DATE_INVALID is one of the narrowest errors Chrome raises. It is not a verdict on who issued the certificate, on the domain it was issued for, or on the strength of the encryption. It says one thing only: at the moment of the connection, the browser’s clock fell outside the period the certificate is valid […]
Most browser certificate warnings mean something was configured wrong. NET::ERR_CERT_REVOKED is different. It means the certificate was issued correctly, was accepted as genuine, and then the Certificate Authority that issued it deliberately cancelled it before its expiry date. Nothing is broken in the sense of a typo in a config file. Somebody decided this certificate […]
NET::ERR_CERT_SYMANTEC_LEGACY is a Chrome certificate error from a very specific moment in web history. It marked a certificate that traced back to Symantec’s old certificate authority, the infrastructure behind the Symantec, Thawte, GeoTrust, RapidSSL, VeriSign and Equifax brands, which Google removed from Chrome’s trust in 2018. That story is finished, and so is the error […]
Chrome shows NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM when a site presents a certificate signed with a hashing algorithm the browser no longer accepts. In practice, that algorithm is SHA-1. The error reads like a server misconfiguration, but it is narrower than that. A signature algorithm is written into a certificate at the moment the Certificate Authority signs it, and […]
NET::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN is one of the few Chrome errors that almost nobody sees for the reason the internet says they see it. Most guides describe it as a site owner’s configuration mistake, something you caused by pinning the wrong key and can undo by reinstalling your certificate. That has not been true for years. The error […]
Most certificate problems announce themselves. This one does not. When an intermediate certificate in your chain expires, your own certificate stays valid, your monitoring stays green, and the site keeps loading perfectly on the machine you check it from. Meanwhile some share of your visitors cannot reach you at all, and the ones who can […]
Most SSL connection errors give you something to try. This one does not. When Chrome shows NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED, the connection was refused because of what the site’s certificate contains, or rather what it fails to contain, and none of the usual visitor-side fixes take part in that decision. This guide explains what the error actually checks, […]
