The cybersecurity crowd loves to pitch certificate automation as some sleek, forward-thinking upgrade for the modern web. But let’s be real: we didn’t get here because everyone suddenly became proactive. We got here because the industry kept messing up. Automation isn’t a reward for good behavior; it’s an intervention. For years,we’ve seen a spectacular parade […]
Certificate automation is a solved problem. The tools exist, the CAs support them, and most IT teams understand the risk of going manual. Yet 38% of organizations still manage certificates with spreadsheets, and 70% admit they don’t have the staff to keep up. The gap between what’s available and what’s adopted isn’t a technical story. […]
The SSL industry already has one countdown on the wall. By 2029, the old annual renewal rhythm will be gone. Certificates will expire faster, automation will be mandatory, and businesses still running on calendar reminders will fall behind. That challenge, at least, is legible. The harder problem is not about time. It’s about visibility. Post-quantum […]
On May 8, 2026, Let’s Encrypt temporarily stopped issuing certificates after detecting an internal error in its certificate system. Existing certificates remained valid, but new requests and automated renewals were affected during the interruption. Service was later restored after Let’s Encrypt changed the affected issuance path. What Happened Inside Let’s Encrypt? The interruption traced back […]
If SSL certificates were only about encryption, the paid market should have collapsed by now. Basic HTTPS is everywhere. Free DV certificates protect ordinary websites. Hosting panels turn SSL into a checkbox. Browsers no longer treat encrypted pages as special; they flag unencrypted ones as broken. Yet paid SSL still exists. The market thrives because […]
Picking a code signing certificate provider is harder than it should be. Four publicly-trusted Certificate Authorities cover almost every legitimate buying scenario: Sectigo, Comodo, DigiCert, and GoGetSSL. At first glance they all look similar. They issue the same X.509 certificates, follow the same CA/Browser Forum rules, and ship hardware tokens that meet the same FIPS […]
SSL certificate validity is changing, and the shift has already started. The industry is moving away from long-lived certificates and toward much shorter lifetimes, forcing a different approach to how you manage SSL/TLS. This is not a minor update. Reduced SSL validity increases the frequency at which you issue certificates, validate domains, and handle renewals. […]
SSL certificates are often treated as a set-and-forget layer of infrastructure. Once installed, browsers stay quiet, and encryption fades into the background. From a support perspective, reality looks very different. Behind routine installations sits a steady flow of tickets where certificates are technically valid, correctly deployed, and still failing in ways that aren’t immediately visible. […]
You’ve just received your SSL certificate files and notice two extensions: .crt and .cer. Your server expects one, your certificate authority (CA) sent the other. Before you start troubleshooting, here’s the short answer: both file extensions hold the same X.509 certificate data, and the difference is mostly a naming convention. But “mostly” is doing some […]
At SSL Dragon, we work with SSL certificates across a wide range of environments, from simple single-domain sites to modern stacks where TLS is deliberately spread across multiple layers. Over time, that range makes one thing clear: TLS itself is stable, but the way it’s understood hasn’t kept pace with its evolution. Today, HTTPS commonly […]
cPanel’s built-in AutoSSL issues free domain-validated certificates and nothing else, so a certificate from a commercial certificate authority has to come from somewhere else. With acme.sh you can issue one over ACME with External Account Binding and have it installed into cPanel automatically at every renewal, using the deploy hook acme.sh ships for exactly this […]
OPNsense issues and renews its own TLS certificates through the os-acme-client plugin, a graphical front end to the acme.sh client. This guide covers the case most administrators face when the certificate is not a free one: issuing from a commercial certificate authority, which means registering the ACME account with External Account Binding credentials, a key […]
IIS has no ACME client of its own, so certificate automation on Windows is handled by win-acme, a command-line client that requests the certificate, writes it into the Windows certificate store, updates the IIS binding and registers a scheduled task to renew it. This guide covers the case that most business environments face: issuing from […]
Certbot is the reference ACME client on Linux, and it does more than fetch a certificate: its Apache and NGINX plugins edit the server configuration, set up the HTTPS redirect and reload the service, then keep the certificate renewed on a timer. It works with a commercial certificate authority as well as a free one, […]
ACME (Automated Certificate Management Environment) is the protocol that lets a client request an SSL certificate, prove it controls the domain, and renew the certificate later without anyone opening a console. It matters more every year. The CA/Browser Forum has capped certificate lifetimes at 200 days since March 2026, dropping to 100 days in March […]
Signing a Windows executable attaches a cryptographic proof of two things: who published the file, and that nobody has altered a single byte of it since. Windows checks that proof every time the file is downloaded, installed or run, and an unsigned installer gets a noticeably rougher reception than a signed one. The signing itself […]
Firefox blocks a page with SEC_ERROR_REUSED_ISSUER_AND_SERIAL and, unlike almost every other certificate warning, gives you no way to continue. There is no Advanced section and no button to accept the risk. The message tells you the certificate “contains the same serial number as another certificate issued by the certificate authority”, which sends most people off […]
The PR_END_OF_FILE_ERROR is one of the least descriptive messages Firefox can show you. The page simply fails, the wording gives no hint about which side of the connection gave up, and most of the advice you will find online sends you into Firefox’s settings when the problem is often somewhere else entirely. In this guide, […]
ERR_SSL_SERVER_CERT_BAD_FORMAT is the error Chrome shows when the certificate a website sent could not be read at all. The page fails with the heading “This site can’t provide a secure connection” and a line saying the site doesn’t adhere to security standards. There is no Advanced link, no button, and no way to continue. That […]
If you searched for ERR_SPDY_PROTOCOL_ERROR, you are chasing an error message that Chrome stopped printing years ago. The protocol it names, SPDY, was retired in 2016, and Chrome renamed the error itself in 2019. The failure behind it is still very much alive, though. It just goes by a different name now: ERR_HTTP2_PROTOCOL_ERROR. This guide […]
