Certificate Monitoring

Mutual TLS makes the client prove its identity with a certificate too. Here is the nginx config, the client commands, and the error you get when one is missing.

ECDSA P-256 is the right default for new certificates: smaller keys and faster signing, with RSA as a fallback for legacy clients. Numbers, commands, config.

A wildcard covers every subdomain from one key; a multi-SAN cert names each host. One hides your hostnames, the other limits the damage. Default to named certs.

On August 14, 2026, an invalid TLS certificate blocked Claude's own status page. If a near-trillion-dollar company can miss a certificate, so can you.

A certificate chain that works in your browser can fail for API and mobile clients. Here is why chains break and how to verify one from outside.

A CAA record names which CAs may issue certificates for your domain. One DNS line closes off a whole class of mis-issuance. Here is how to use it.

Let's Encrypt shut off its OCSP responders in 2025, but most CAs still run theirs. Here is where revocation stands and how to check what your certs carry.

Quantum-resistant algorithms are landing in TLS now, not in some distant future. Here is what is changing for certificates and what to do before it reaches you.

An expired SSL certificate fails closed: browsers block the page and API clients refuse to connect. Here is what breaks and how to fix it fast.

Renewing an SSL certificate is more than clicking renew. Here is the full process, automated and manual, how to deploy it everywhere, and how to verify it took.

As certificate lifetimes shrink, manual renewal stops scaling. Here is how ACME automates issuance and renewal, and where automation still quietly breaks.

SSL certificate monitoring tracks expiry, chains, and issuance across every endpoint you run. Set it up so a certificate never takes down production.

Every publicly trusted certificate is logged to CT logs, so any certificate issued for your domain is public. Here's how to monitor for unauthorized issuance.

The CA/Browser Forum has mandated a phased reduction in TLS certificate validity, reaching a 47-day maximum by 2029. Here's the timeline and impact.

Let's Encrypt and ACME automation make certificate management nearly frictionless. But automation can fail silently, and you won't know until you're down.

A working checklist for renewing TLS certificates without causing an outage. Covers planning, validation, and post-deployment verification.

Most certificate outages stem from certificates the ops team didn't know existed. Build a complete inventory using DNS, CT logs, and internal discovery.

A certificate just expired in production. Here's the triage order, the fastest ways to restore service, and what to document before the incident closes.

Expired certificates cause predictable, avoidable outages. Here is how SSL certificate expiration monitoring works and how to set alerts that fire in time.