Blog

ECDSA P-256 is the right default for new certificates: smaller keys and faster signing, with RSA as a fallback for legacy clients. Numbers, commands, config.

A wildcard covers every subdomain from one key; a multi-SAN cert names each host. One hides your hostnames, the other limits the damage. Default to named certs.

On August 14, 2026, an invalid TLS certificate blocked Claude's own status page. If a near-trillion-dollar company can miss a certificate, so can you.

A dedicated sending IP sounds like an upgrade, but for most senders it is a self-inflicted deliverability wound. Here is when each model is the right call.

A certificate chain that works in your browser can fail for API and mobile clients. Here is why chains break and how to verify one from outside.

A CAA record names which CAs may issue certificates for your domain. One DNS line closes off a whole class of mis-issuance. Here is how to use it.