The cybersecurity crowd loves to pitch certificate automation as some sleek, forward-thinking upgrade for the modern web. But let’s be real: we didn’t get here because everyone suddenly became proactive. We got here because the industry kept messing up. Automation isn’t a reward for good behavior; it’s an intervention. For years,we’ve seen a spectacular parade […]
Certificate automation is a solved problem. The tools exist, the CAs support them, and most IT teams understand the risk of going manual. Yet 38% of organizations still manage certificates with spreadsheets, and 70% admit they don’t have the staff to keep up. The gap between what’s available and what’s adopted isn’t a technical story. […]
The SSL industry already has one countdown on the wall. By 2029, the old annual renewal rhythm will be gone. Certificates will expire faster, automation will be mandatory, and businesses still running on calendar reminders will fall behind. That challenge, at least, is legible. The harder problem is not about time. It’s about visibility. Post-quantum […]
On May 8, 2026, Let’s Encrypt temporarily stopped issuing certificates after detecting an internal error in its certificate system. Existing certificates remained valid, but new requests and automated renewals were affected during the interruption. Service was later restored after Let’s Encrypt changed the affected issuance path. What Happened Inside Let’s Encrypt? The interruption traced back […]
If SSL certificates were only about encryption, the paid market should have collapsed by now. Basic HTTPS is everywhere. Free DV certificates protect ordinary websites. Hosting panels turn SSL into a checkbox. Browsers no longer treat encrypted pages as special; they flag unencrypted ones as broken. Yet paid SSL still exists. The market thrives because […]
Picking a code signing certificate provider is harder than it should be. Four publicly-trusted Certificate Authorities cover almost every legitimate buying scenario: Sectigo, Comodo, DigiCert, and GoGetSSL. At first glance they all look similar. They issue the same X.509 certificates, follow the same CA/Browser Forum rules, and ship hardware tokens that meet the same FIPS […]
SSL certificate validity is changing, and the shift has already started. The industry is moving away from long-lived certificates and toward much shorter lifetimes, forcing a different approach to how you manage SSL/TLS. This is not a minor update. Reduced SSL validity increases the frequency at which you issue certificates, validate domains, and handle renewals. […]
SSL certificates are often treated as a set-and-forget layer of infrastructure. Once installed, browsers stay quiet, and encryption fades into the background. From a support perspective, reality looks very different. Behind routine installations sits a steady flow of tickets where certificates are technically valid, correctly deployed, and still failing in ways that aren’t immediately visible. […]
You’ve just received your SSL certificate files and notice two extensions: .crt and .cer. Your server expects one, your certificate authority (CA) sent the other. Before you start troubleshooting, here’s the short answer: both file extensions hold the same X.509 certificate data, and the difference is mostly a naming convention. But “mostly” is doing some […]
At SSL Dragon, we work with SSL certificates across a wide range of environments, from simple single-domain sites to modern stacks where TLS is deliberately spread across multiple layers. Over time, that range makes one thing clear: TLS itself is stable, but the way it’s understood hasn’t kept pace with its evolution. Today, HTTPS commonly […]
SSL_ERROR_NO_CYPHER_OVERLAP is the message Firefox shows when it cannot complete a TLS handshake with a website. The page never loads, and the error points at cipher suites, the algorithms a browser and a server use to encrypt a connection between them. The name only tells half the story. Firefox reports this error in several situations […]
ERR_SSL_BAD_RECORD_MAC_ALERT is one of the less common Chrome SSL errors, and one of the most misread. It carries the letters “SSL”, so most troubleshooting guides treat it as a certificate problem. It is not one. By the time this error appears, the certificate has already been presented, checked, and accepted, and the connection is already […]
A code signing order placed against a YubiKey 5 FIPS you already own does not just need a CSR. It needs proof that the private key behind that CSR was created inside the token and has never existed anywhere else. That proof is the attestation package, and it is the part most people get wrong. […]
Your Certificate Authority has finished validation and sent you the issued code signing certificate. The private key never left your YubiKey 5 FIPS, and it never will. What is left is a small but easy to get wrong step: writing that certificate into the same PIV slot that holds the key which signed your Certificate […]
Sectigo will issue a code signing certificate onto hardware you already own, but only if you can prove the private key was born inside that hardware and cannot leave it. On a Thales Luna Network HSM the proof is a public key confirmation, or PKC: a certificate chain the HSM itself signs, attesting that a […]
Enrollment is the part of an EV code signing order that most guides stop at. The part that actually blocks people comes after: a sealed package arrives from a courier, it contains a USB token and a letter, and nothing on your machine can see either of them yet. This guide covers that stretch, from […]
Buying a code signing certificate involves one option that behaves differently from every other field on the order form. Long before validation starts, you have to say where the private key is going to live: on a hardware token the Certificate Authority builds and mails to you, or on hardware you already own and operate. […]
You have paid for a code signing certificate and nothing has arrived. The order sits at “pending validation”, the Certificate Authority has emailed you asking for something, and it is not obvious what would actually close the request. That is the normal state of a code signing order, because code signing is validated against your […]
You have ordered a Sectigo code signing certificate and nothing has arrived. That is normal: the certificate does not exist yet. Sectigo has to establish who you are before it will sign anything with your name in it, and that vetting is the slowest part of the purchase by a wide margin. This guide covers […]
A code signing certificate is not installed the way an SSL certificate is. There is no file to drop onto a server. The private key has to be created inside a piece of certified hardware and stay there for the certificate’s whole life, which changes the order of every step that follows: what you choose […]
