The cybersecurity crowd loves to pitch certificate automation as some sleek, forward-thinking upgrade for the modern web. But let’s be real: we didn’t get here because everyone suddenly became proactive. We got here because the industry kept messing up. Automation isn’t a reward for good behavior; it’s an intervention. For years,we’ve seen a spectacular parade […]
Certificate automation is a solved problem. The tools exist, the CAs support them, and most IT teams understand the risk of going manual. Yet 38% of organizations still manage certificates with spreadsheets, and 70% admit they don’t have the staff to keep up. The gap between what’s available and what’s adopted isn’t a technical story. […]
The SSL industry already has one countdown on the wall. By 2029, the old annual renewal rhythm will be gone. Certificates will expire faster, automation will be mandatory, and businesses still running on calendar reminders will fall behind. That challenge, at least, is legible. The harder problem is not about time. It’s about visibility. Post-quantum […]
On May 8, 2026, Let’s Encrypt temporarily stopped issuing certificates after detecting an internal error in its certificate system. Existing certificates remained valid, but new requests and automated renewals were affected during the interruption. Service was later restored after Let’s Encrypt changed the affected issuance path. What Happened Inside Let’s Encrypt? The interruption traced back […]
If SSL certificates were only about encryption, the paid market should have collapsed by now. Basic HTTPS is everywhere. Free DV certificates protect ordinary websites. Hosting panels turn SSL into a checkbox. Browsers no longer treat encrypted pages as special; they flag unencrypted ones as broken. Yet paid SSL still exists. The market thrives because […]
Picking a code signing certificate provider is harder than it should be. Four publicly-trusted Certificate Authorities cover almost every legitimate buying scenario: Sectigo, Comodo, DigiCert, and GoGetSSL. At first glance they all look similar. They issue the same X.509 certificates, follow the same CA/Browser Forum rules, and ship hardware tokens that meet the same FIPS […]
SSL certificate validity is changing, and the shift has already started. The industry is moving away from long-lived certificates and toward much shorter lifetimes, forcing a different approach to how you manage SSL/TLS. This is not a minor update. Reduced SSL validity increases the frequency at which you issue certificates, validate domains, and handle renewals. […]
SSL certificates are often treated as a set-and-forget layer of infrastructure. Once installed, browsers stay quiet, and encryption fades into the background. From a support perspective, reality looks very different. Behind routine installations sits a steady flow of tickets where certificates are technically valid, correctly deployed, and still failing in ways that aren’t immediately visible. […]
You’ve just received your SSL certificate files and notice two extensions: .crt and .cer. Your server expects one, your certificate authority (CA) sent the other. Before you start troubleshooting, here’s the short answer: both file extensions hold the same X.509 certificate data, and the difference is mostly a naming convention. But “mostly” is doing some […]
At SSL Dragon, we work with SSL certificates across a wide range of environments, from simple single-domain sites to modern stacks where TLS is deliberately spread across multiple layers. Over time, that range makes one thing clear: TLS itself is stable, but the way it’s understood hasn’t kept pace with its evolution. Today, HTTPS commonly […]
A mail server needs a publicly trusted certificate for the hostname clients connect to, and it usually needs it in two or three places at once: Postfix for SMTP, Dovecot for IMAP and POP3, sometimes Exim instead of Postfix. This guide issues one certificate with acme.sh from a commercial certificate authority using External Account Binding, […]
TrueNAS has an ACME client built in, but it cannot authenticate to a certificate authority that requires External Account Binding, and that is what commercial CAs require. So the practical route is to issue the certificate with acme.sh on a machine you already run, then push it into TrueNAS over the API on every renewal. […]
DSM has its own Let’s Encrypt integration, but it cannot authenticate to a certificate authority that requires External Account Binding, which is what commercial CAs use. So the working route is to issue the certificate with acme.sh on a machine you already run, and let acme.sh’s synology_dsm deploy hook push it into DSM at every […]
pfSense issues and renews its own TLS certificates through the ACME package, a graphical front end to the acme.sh client that Netgate maintains. It handles commercial certificate authorities properly, including External Account Binding, so there is no need for an external machine in the normal case. What trips people up is that a commercial CA […]
FortiGate can request and renew its own TLS certificate over ACME, the protocol defined in RFC 8555. This guide covers the case most firewall administrators actually face: issuing that certificate from a commercial certificate authority rather than a free one, which means the FortiGate has to authenticate to the CA with External Account Binding credentials, […]
ACME failures are usually terse, and the useful part is buried in a URN that looks like noise. This guide explains what each of the common errors actually means, where in the process it happens, and what to change. The errors are grouped by which leg of the exchange broke, because that is what decides […]
Plesk can issue and renew certificates from a commercial certificate authority over ACME without any scripting, using its own ACME SSL extension. That extension supports External Account Binding, which is the part commercial CAs require and the reason people assume the panel cannot do it. This guide covers that route first, then the manual acme.sh […]
LiteSpeed has no ACME client of its own, so certificates come from acme.sh, which issues them and then runs a reload command so the running server picks them up. This guide covers both editions, OpenLiteSpeed and LiteSpeed Enterprise, using a commercial certificate authority, which means registering the ACME account with External Account Binding credentials.
Remote Desktop presents a self-signed certificate out of the box, which is why users get a warning every time they connect. You can replace it with a publicly trusted certificate and keep it renewed automatically using win-acme, including certificates from a commercial certificate authority that requires External Account Binding. The part that needs care is […]
Kubernetes handles certificates differently from every other platform in this series. There is no ACME client you run and no file you copy: cert-manager is a controller that watches for certificate resources, talks to the CA, stores the result in a Kubernetes secret and renews it on its own. This guide sets that up against […]
