What's New on FixMyCert

New Guide: DigiCert Global Root G2: Verify Your Certificate Chain

Baltimore CyberTrust Root expired in May 2025 and Microsoft disables it on August 27, 2026. Here's how to confirm your chain moved to DigiCert Global Root G2.

New Guide: ERR_SSL_VERSION_OR_CIPHER_MISMATCH — What It Means and How to Fix It

The browser error that means your server and the client share no TLS version or cipher suite. Diagnose it in one command, then fix it on nginx, Apache, IIS/Schannel, F5 BIG-IP, HAProxy, or Java — and understand why RFC 10015 is about to make it far more common.

The error looks like a browser problem and almost never is one. It is a negotiation failure — the client and the server share no TLS version or cipher suite in common — and it happens before certificate validation is ever reached, which is why a certificate check will not find it. The guide covers the four causes, how to read what a server actually offers rather than trusting the config file, the fix for each major platform, and why RFC 10015 is about to make this error far more common on endpoints that have quietly negotiated RSA key exchange for a decade.

• New guide at /guides/err-ssl-version-or-cipher-mismatch
• Diagnosis with openssl s_client, nmap ssl-enum-ciphers, and openssl ciphers -V -stdname
• Fixes for nginx, Apache, IIS/Schannel, F5 BIG-IP, HAProxy, and Java
• RFC 10015: 222 cipher suites re-marked, 183 of them MUST NOT
• The verification step that is supposed to FAIL — and why a pass there means you are not done

New Guide: What Are SPIFFE and SPIRE? Workload & AI Agent Identity

A new guide explains SPIFFE and SPIRE from a PKI standpoint — what is inside the X.509-SVID, where the identity lives in the URI SAN, what SPIRE's attestation model adds over a plain internal CA, and how this applies to AI agent identity in the wake of the July 2026 Hugging Face breach.

SPIFFE gives every workload — container, microservice, AI agent — a short-lived X.509 certificate as its identity. SPIRE issues and rotates those certificates automatically, but only after attestation proves what the workload actually is. The guide covers the SPIFFE ID format, SVID types (X.509 vs JWT), node and workload attestation, the comparison to things PKI engineers already know, and a detailed look at the Hugging Face breach as a case study for why harvestable static credentials are the real risk.

• New guide at /guides/spiffe-spire
• SVID comparison table: X.509-SVID vs JWT-SVID
• SPIFFE vs things you already know comparison table
• Code blocks: openssl x509 URI SAN inspection, spire-server entry create, spire-agent api fetch
• AI agent identity section including July 2026 Hugging Face breach analysis
• Connection to the public-certificate mTLS/clientAuth EKU sunset
• Six-question FAQ

New Guide: FIPS 140-2 vs 140-3 — What Changed and Why September 2026 Matters

A new guide explains the FIPS 140-2 to 140-3 transition: on September 22, 2026, CMVP moves every remaining active FIPS 140-2 certificate to the Historical List. The guide covers what actually changed technically, what the Historical List means for procurement, and what vendors, buyers, and PKI teams should do before the deadline.

FIPS 140-3 aligned the U.S. cryptographic module standard with ISO/IEC 19790 and ISO/IEC 24759, renamed critical security parameters to sensitive security parameters (SSPs), formalized software and hybrid module types, tightened Level 4 authentication to multi-factor, and replaced power-on self-tests with pre-operational self-tests. The guide walks through each change, the full 2019–2026 transition timeline, and why post-quantum algorithms (FIPS 203/204/205) validating only under 140-3 make this a one-way door. A five-minute verification section shows how to look up your module on the CMVP list and check which FIPS provider your OpenSSL installation actually loads.

• New guide at /guides/fips-140-2-vs-140-3
• Full transition timeline: 2019 approval through the September 22, 2026 Historical List move
• What "Historical List" actually means — procurement posture, not revocation
• Technical differences: SSPs, module types and roles, Level 4 MFA, pre-operational self-tests, degraded operation
• Why PQC (ML-KEM, ML-DSA, SLH-DSA) validating only under 140-3 forces the move
• Copy-paste OpenSSL commands to verify which FIPS provider your systems load
• Audience-specific action lists for vendors, buyers, and PKI operators, plus FAQ

F5 SSL Profiles Guide: TLS Deep-Dive and Cipher Config Sections Added

The F5 BIG-IP SSL Profiles guide now covers what BIG-IP is actually doing at the TLS layer — the SSL vs TLS naming history, TLS 1.3 on 14.0+, and the decrypt/re-encrypt split — plus a new section on controlling TLS versions and ciphers via tmsh, including Cipher Groups.

The guide already ranked for F5 SSL profile terms, but readers searching for "F5 TLS" or "F5 SSL" head terms were landing on a page that assumed they already knew the basics. Two new sections fill that gap. The first explains what BIG-IP is actually doing: SSL is just legacy naming, TLS 1.2 is the baseline, TLS 1.3 auto-negotiates on 14.0+, and the Client SSL / Server SSL split enables the terminate-inspect-re-encrypt pattern at the heart of every advanced traffic policy. The second section gives the exact tmsh commands to disable TLS 1.0/1.1, assign a Cipher Group, and verify what the VIP actually negotiates. Both sections link out to the SSL checker tool and the openssl s_client guide for hands-on verification.

• New section: "F5 and SSL/TLS: What BIG-IP Is Actually Doing" — TLS naming history, 1.3 on 14.0+, decrypt/re-encrypt split explained
• New section: "Configuring TLS Versions and Ciphers on F5" — tmsh commands for disabling old protocols and assigning Cipher Groups
• Internal links to SSL checker tool and openssl s_client guide for post-change verification
• Meta title updated to target "F5 SSL/TLS" and "F5 TLS" head terms

New Guide: 90-Day Certificates — Why They Exist and How to Stop Renewing by Hand

A new guide explains what 90-day certificates are, why short lifetimes exist as a security decision, where certificate lifetimes are heading (Let's Encrypt's move to 45- and 6-day certs, the CA/Browser Forum's 47-day rule by 2029), and how to automate renewal with ACME tools like Certbot, Caddy, and cert-manager.

The guide covers the full story: a 90-day cert is technically identical to any other X.509 TLS certificate — only the notAfter date is shorter. Let's Encrypt introduced 90 days in 2015 to force automation and make revocation-by-expiry practical. But 90 days is no longer the aggressive end of the curve — it's the comfortable one. The guide includes both the Let's Encrypt migration timeline (shortlived 6-day profile GA, default moving to 45 by Feb 2028) and the CA/Browser Forum SC-081v3 schedule (200 → 100 → 47 days by March 2029). The automation section covers Certbot dry-run verification and the --preferred-profile shortlived flag, Caddy zero-config TLS, cert-manager Kubernetes integration, ARI renewal timing, and independent expiry monitoring. A closing CTA links to the 47-Day Readiness Audit Checklist.

• New guide at /guides/90-day-certificates
• Exact Let's Encrypt migration timeline: shortlived GA (Jan 2026), tlsserver opt-in (May 2026), classic at 64-day (Feb 2027), final 45-day default (Feb 2028)
• CA/Browser Forum SC-081v3 table: 200 days (now) → 100 days (2027) → 47 days (2029)
• Automation paths: Certbot with --preferred-profile, Caddy, cert-manager, ARI (RFC 9773)
• FAQ covering the four most common 90-day certificate questions
• Closing CTA to the 47-Day Readiness Audit Checklist

CSR Checker: New Explainer, Pre-Submit Checklist, and FAQ

The CSR Checker tool page now explains exactly what the decoder shows you, walks through a five-point checklist to run before you submit a CSR to your certificate authority, and answers the five most common CSR questions — including whether it's safe to paste a CSR into a browser tool (it is).

The CSR decoder itself is unchanged — everything still happens locally in your browser, and nothing is uploaded. What's new is the context around it: an explainer covering what the checker decodes (Subject, SANs, key algorithm and size, signature algorithm), a pre-submission checklist that catches the classic rejection causes (missing SAN entries, undersized keys, SHA-1 signatures, mismatched Organization fields), and an FAQ with structured data so the answers can surface directly in search results. The page also now links onward to the SSL checker for post-issuance verification and to the OpenSSL guides for generating and testing certificates from the command line.

• New "What This CSR Checker Does" explainer directly under the tool
• Five-point pre-submission checklist: CN, SANs, key size, signature algorithm, and OV/EV Organization matching
• Five-question FAQ with FAQPage structured data for search visibility
• New cross-links to the SSL checker and the OpenSSL installation and s_client guides

OpenSSL s_client Guide: Worked Examples With Real Terminal Output

The openssl s_client guide now opens with a worked-examples section covering the flags you'll actually use — -connect, -servername, -showcerts, plus a working recipe for checking Certificate Transparency SCTs — each with a copy-paste command and trimmed real terminal output, and a one-liner tip for grabbing a cert's dates and subject without the full handshake.

Syntax references are fine, but nothing beats seeing what the command actually prints. The new "openssl s_client Examples: The Flags You'll Actually Use" section sits right after the intro and shows a trimmed example of the -connect output (handshake, certificate chain, negotiated TLSv1.3 session), explains the missing-SNI default-certificate pitfall that bites on shared hosting and CDNs, and covers using -showcerts to spot missing intermediates — the #1 cause of "certificate not trusted" on some clients but not others. The section also cross-links to the SSL checker tool for browser-based checks and to the OpenSSL installation guide, which now links back with a contextual pointer to testing your first connection.

• New examples section on /guides/openssl-s-client with -connect, -servername, and -showcerts walkthroughs
• Trimmed real terminal output for -connect: certificate chain, ISRG Root X1 depth, TLSv1.3 session details
• Quick-tip one-liner: pipe s_client into openssl x509 for dates, subject, and issuer only
• Cross-links added between the s_client guide, the OpenSSL installation guide, and the SSL checker tool
• New Certificate Transparency walkthrough: why -ct fails on modern OpenSSL builds and the x509 one-liner that decodes embedded SCTs instead

Compliance Hub: Smarter Deadline Cards, Urgency Colors, and CSV Export

The PKI Compliance Hub deadline cards got a round of polish — severity ratings now render as clean pills instead of raw words, date-change notes appear on cards, days-remaining counts are color-coded by urgency, and a new Export CSV button downloads the deadline feed with your active filters applied.

A batch of quality-of-life upgrades landed on the Compliance Hub. Deadline cards whose impact field is a bare severity rating ("high", "medium", "low") now show a tidy severity pill next to the MAJOR IMPACT or IMPACT label instead of echoing the raw word, while full-sentence impact statements render as before. Deadlines with an explanatory note — like a date that moved — now surface it as a muted "Note:" line right on the card, and completed deadlines in the Recently Occurred section finally show the "~ Est." badge for estimated dates, matching upcoming cards. Every days-remaining count on the page — the hero countdown, the Upcoming Deadlines strip, and the Also Approaching cards — is now color-coded by urgency using the same thresholds as the timeline legend: red at 30 days or fewer, amber through 60, green beyond. And a new Export CSV button in the page header downloads the full deadline feed as a spreadsheet-ready file; if you have timeline filters active, the export matches exactly what's on screen.

• Severity pills on impact banners — bare "high"/"medium"/"low" ratings render as clean badges
• "Note:" lines on deadline cards surface date changes and caveats from the data feed
• Days-remaining counts color-coded by urgency: red ≤30 days, amber 31–60, green beyond
• "~ Est." badge now appears on estimated dates in the Recently Occurred section too
• New Export CSV button downloads all deadlines — or just the ones matching your active filters
• Compliance Hub guide refreshed with a live hero and coverage of all the new features

Certificate Transparency Guide Updated: Chrome Now Mandates Pre-Issuance CT Logging

The Certificate Transparency guide now covers the Chrome Root Program v1.8 mandate (effective June 15, 2026) requiring publicly trusted CAs to log precertificates to CT logs before issuance — CT logging is no longer just best practice, it's a hard requirement for Chrome trust.

Chrome Root Program Policy v1.8 changed the CT landscape: as of June 15, 2026, CAs must submit precertificates to qualified CT logs and embed SCTs before a certificate is ever issued. The guide now includes a dedicated section explaining what the mandate requires, why precertificates (with their poison extension) carry the requirement, the difference between Usable and Qualified log states, and what subscribers should verify and monitor. The intro and CT workflow steps were updated to reflect that pre-issuance logging is now mandatory for Chrome-trusted CAs, and the timeline callout shows the before/after: "SHOULD log within 24 hours" is now "MUST log before issuance."

• New section: Chrome Now Requires CT Logging Before Issuance (Effective June 15, 2026)
• Explains Chrome Root Program Policy v1.8 §1.3.4.1 pre-issuance precertificate logging requirement
• Covers Usable vs Qualified CT log states and what they mean for CAs
• Subscriber guidance: what to verify in your certificates and how to monitor CT logs
• CT workflow steps corrected — precertificate submission now happens before issuance

Compliance Hub Hero Now Shows Live Deadline Data

The PKI Compliance Hub hero no longer uses a static image with a baked-in date. It now displays the actual next upcoming deadline — title, date, and days remaining — computed live from the compliance API on every visit, so it can never go stale.

The old hero image had "Next Deadline: March 15, 2026" rendered into the pixels — accurate the day it was made, wrong ever since that deadline passed. The new hero overlays live text on a dark navy timeline background: the soonest upcoming deadline with its date and a days-remaining count, plus a stat row showing how many deadlines and sources the hub tracks. All of it is computed from the same live API feed that powers the rest of the page, with dates handled in UTC so they never render a day early in US timezones. Estimated dates are clearly marked so a projected deadline is never presented as exact. The social share image was also replaced with a date-free design that stays evergreen.

• Next-deadline card computed live on every page load — title, UTC date, and days remaining
• Estimated deadlines display a "~ Est." marker instead of posing as exact dates
• Stat row shows total tracked deadlines and sources, straight from the API
• Day counts computed against UTC midnight so they always match the displayed date
• New date-free social share image replaces the stale baked-date graphic

New Guide: Harvest Now, Decrypt Later — What It Is and What to Do in 2026

A new guide explains the harvest-now-decrypt-later (HNDL) threat: attackers recording encrypted traffic today to decrypt it once quantum computers arrive, and how to stop the exposure with hybrid post-quantum TLS key exchange today.

The guide covers who is actually at risk (long-lived sensitive data like health records, financial data, and government secrets), the standards timeline from NIST FIPS 203 through CNSA 2.0, how to enable X25519MLKEM768 hybrid key exchange in OpenSSL 3.5 and nginx today, why Merkle Tree Certificates are the coming answer for post-quantum authentication, and a four-step practitioner checklist. All four internal guide links (ACME Protocol, ARI Readiness, 47-Day Timeline, DNS-PERSIST-01 Explained) verified against the live registry.

• New guide at /guides/harvest-now-decrypt-later
• Quick-answer callout: HNDL threat and hybrid key exchange in plain English
• Command examples for checking OpenSSL version, testing hybrid negotiation, and configuring nginx
• NIST/CNSA 2.0 migration timeline with key dates
• Merkle Tree Certificates explained — Let's Encrypt staging in H2 2026
• Practitioner checklist with links to ACME Protocol, ARI Readiness, and 47-Day Timeline guides

New Guide: CAA Account Pinning (RFC 8657)

A new guide explains how to pin certificate issuance to a specific ACME account and validation method using the RFC 8657 accounturi and validationmethods CAA parameters — mandatory for all public CAs on March 15, 2027.

The guide covers the full deployment lifecycle: what RFC 8657 adds to base CAA, both parameters precisely, how to retrieve your account URI from certbot/acme.sh/cert-manager/GTS/DigiCert, a four-step safe rollout process (inventory → syntax → test → rollback), and a deployment checklist with the canonical record format.

• New guide at /guides/caa-account-pinning
• Covers accounturi and validationmethods parameters in full
• Per-CA account URI retrieval: Let's Encrypt, Google Trust Services, DigiCert
• Safe rollout checklist — avoids the silent self-lockout failure mode
• SC-098v2 mandate context: mandatory CA support from 2027-03-15

Video added to the ARI Readiness Guide

The ARI Readiness Guide now opens with an embedded "Watch: ARI Explained" video, giving readers a quick visual overview of ACME Renewal Information before diving into the implementation details.

A lazy-loaded, responsive 16:9 YouTube player now sits directly below the table of contents on the ARI Readiness Guide, covering ACME Renewal Info and mass revocation defense. It follows the same embed card pattern used across other guides on the site.

• Embedded YouTube video on /guides/ari-readiness
• Placed below the table of contents, above "What ARI Is and Why It Matters Now"
• Lazy-loaded, no autoplay, mobile-friendly full-width layout

Video walkthrough added to the Mass Revocation Response Plan Kit page

The Mass Revocation Response Plan Kit sales page now includes an embedded video walkthrough so visitors can see what the kit covers before buying.

A short video now sits just below the hero on the Mass Revocation Response Plan Kit page, giving buyers a quick overview of mass revocation readiness and what the kit delivers. It uses the same responsive 16:9 player styling as the rest of the site and plays inline with fullscreen support.

• Embedded YouTube walkthrough on /products/mass-revocation-response-plan
• Responsive 16:9 player placed directly below the hero section
• Matches the site-wide video embed card styling

New guide: How to Find Client Authentication Certificates

A practical discovery guide for teams who need to audit their environment for dual-EKU certificates before CA removal deadlines break partner integrations at renewal.

Most teams don't know they rely on clientAuth until a renewal drops the EKU and a gateway rejects the new cert. This guide covers every discovery layer — single-cert OpenSSL inspection, live endpoint pulls, host-level file sweeps, PowerShell store queries, CA portal filters, CT log enumeration, and network scans — plus a triage table showing which findings are cosmetic vs. high-risk. The deadlines table is live-fetched from the Compliance Hub API so the Sectigo, DigiCert, and Chrome enforcement dates stay current without manual edits.

• Six discovery steps from a single PEM file all the way to estate-wide inventory
• Live deadlines table filtered by clientauth category, sorted ascending, with Past/Upcoming status computed at render time
• Inline date references for Sectigo, DigiCert, and Chrome deadlines fetched by ID from the compliance API
• Triage table mapping each finding type to its real exposure level and recommended action
• Registered in guidesRegistry (certificates category), App.tsx Router + SSRRoutes, and seoMeta

Two new Compliance Hub guides: Chrome/DigiCert legacy root distrust and Mozilla Root Store Policy v3.1

Two editorial guides now live on the Compliance Hub covering the July 1, 2026 Chrome distrust of three legacy DigiCert roots, and the three changes in Mozilla Root Store Policy v3.1 (root key age limit, tighter CP/CPS standards, and 2027 Detailed Controls Reports) — both linked from the hub's guide listing.

Two root-program changes landed on the same date and both needed a plain-language explainer fast. "Chrome Is Distrusting DigiCert's Legacy Roots" walks through what happened, how to check if you're affected with a copyable openssl command, the exact browser symptom (NET::ERR_CERT_AUTHORITY_INVALID) if you get it wrong, and a four-step fix. "Mozilla Root Store Policy v3.1: The Three Changes That Matter" breaks down the 5-year root key age limit, stricter CP/CPS documentation requirements, and the Detailed Controls Reports coming for audit periods starting July 2027 — with a practical prep checklist for CAs. Both guides match the existing compliance guide layout and are linked from the Compliance Hub's "Helpful Compliance Guides" section and the Site Directory.

• New guide: Chrome distrust of DigiCert Trusted Root G4 and Assured ID Root G2/G3 for certs issued on/after July 1, 2026
• New guide: Mozilla Root Store Policy v3.1 — 5-year root key age limit, CP/CPS tightening, and 2027 Detailed Controls Reports
• Both guides include an "Am I affected" section, timeline table, and sourced links to the DigiCert advisory, Chrome Root Program policy, and Mozilla's policy blog/repo
• Linked from the Compliance Hub guide listing and the Site Directory

New: The Certificate War Game — a hands-on exercise chaining all four toolkit tools

A free, guided 30-minute exercise that starts as a single certificate outage and escalates through discovery, mass revocation, and migration — using certfire, certrecon, massrev, and certmove back to back so you can feel why the toolkit is built as a chain, not four separate scripts.

The four toolkit scenarios each teach one tool well, but none of them show how an incident actually unfolds — one problem widening into a bigger one, forcing you to reach for the next tool in the chain. The Certificate War Game fixes that. It walks through five stages of one escalating incident: certfire diagnoses and stages a fix for an expired certificate, certrecon widens the search and turns up a revoked host, massrev turns a CA-wide revocation into a prioritized burndown, and certmove plans and verifies a migration away from the CA that caused it all. Every stage has a "Run it in your browser" tab using the same server-side preset-command mechanism as the scenario pages, and a "Do it for real" tab with the exact local commands and expected output. Collapsible checkpoints let you self-check your understanding before moving on, and the debrief ties every artifact produced back to the toolkit's core idea: the inventory is the spine.

• Five-stage guided incident: outage diagnosis → staged fix → estate-wide discovery → mass revocation burndown → CA migration with evidence
• Every stage offers a live in-browser run and a "do it for real" local track with expected output
• Collapsible checkpoints test understanding at each stage before revealing the answer
• Debrief ties the artifacts together and lists the three real-world escalation triggers from the runbook
• Linked from the toolkit hub with a new banner and from every scenario page's Continue strip

New: PKI Automation Toolkit — four open-source tools for the scenarios that actually page you

A five-page content cluster introducing an open-source, MIT-licensed PKI toolkit. Four practitioner tools — certrecon (discovery), certfire (outage response), massrev (mass revocation), certmove (CA-to-CA migration) — each with its own walkthrough, sample output, FAQ, and (coming soon) browser-runnable Repl.

The toolkit closes the loop between the compliance content on FixMyCert and the actual scripts practitioners need at 2am. Each scenario page reads like a talk track: why this tool exists, what to type, what the screen will say, the questions a skeptical engineer will ask. The hub explains how the four tools chain together — discovery produces the inventory; outage response, mass revocation, and migration all run off the same spine. The GitHub repo, public Repls, and Kit form ID are wired through a single config file so the launch flips on by editing one constant. Hero images are placeholder cards until the Napkin renders land. Body copy is the v1 talk-track baseline; deeper content from the per-tool TALK_TRACK.md files lands as those drafts are finalized.

• Hub page at /cert-automation-toolkit with the four-scenario grid, ASCII flow diagram, design principles, quickstart, and Kit signup
• Four scenario pages: /discovery, /outage-response, /mass-revocation, /migration
• Each scenario: hero, narrative, Repl embed (Coming soon until launch), what-it-does walkthrough, sample output terminal, FAQ accordion, GitHub + download cards, Kit form with per-scenario tag
• Kit form tags: toolkit-lead (hub) plus toolkit-discovery / toolkit-outage / toolkit-mass-revocation / toolkit-migration on the sub-pages
• Schema.org SoftwareApplication JSON-LD on each scenario page, pointing at the GitHub folder and MIT license
• Added to top-nav under Tools as "Cert Automation Toolkit"
• All "swap when live" placeholders (Repl URLs, GitHub URL, Kit form ID, hero image paths, release zip URL, version tag) live in one config file: client/src/data/certAutomationToolkitConfig.ts
• Single TOOLKIT_LAUNCH_LIVE flag flips the Repl iframes from "Coming soon" placeholders to live embeds

New Checklist: Code Signing Governance

A printable, auditor-ready checklist that maps every control in an enterprise code signing program — identity & access, HSM key storage, approval workflow, audit logging, key rotation, and incident response — to CSBR, SOC 2, and ISO 27001 line items.

The new Code Signing Governance demo and the Venafi CodeSign Protect guide both describe the request → approve → HSM sign → audit flow, but until now there was no single artifact you could hand to an auditor that proved your code signing program is sound. This checklist closes that gap. Each item references the specific CA/Browser Forum CSBR clause, SOC 2 Trust Services Criterion, and ISO 27001 Annex A control it satisfies — so the same document covers a CSBR conformance review, a SOC 2 Type II, and an ISO 27001 surveillance audit. Use it as a quarterly self-assessment, a pre-audit dry run, or onboarding material for new compliance staff.

• 6 sections, ~40 controls, every item cross-referenced to CSBR / SOC 2 / ISO 27001
• Identity & Access: separation of duties, MFA, joiner/mover/leaver coverage
• Key Storage: FIPS 140-2 Level 2 HSM evidence, CMVP certificate tracking, non-exportability
• Approval Workflow: time-boxed approvals, signing template versioning, break-glass path
• Audit Logging: tamper-evident records, 2-year minimum retention, file-hash searchability
• Key Rotation: documented schedules, dry-runs, crypto agility plan
• Incident Response: 24-hour CSBR revocation SLA, rehearsed tabletop exercises
• Cross-linked from the Code Signing Governance demo and Venafi CodeSign Protect guide

New Demo: Code Signing Governance — request, approve, sign, audit

A hands-on, step-based demo that walks through an enterprise code signing request end-to-end: developer asks, an approver authorizes against a signing template, the HSM signs without releasing the key, and a tamper-evident audit log records every actor and event.

The new Venafi CodeSign Protect guide explains the architecture and policy model, but until now there was no way to feel the workflow. This demo simulates the same governance flow used by Venafi CodeSign Protect / CyberArk Code Sign Manager: a Project (Acme Installer) configured with an Environment, a Signing Template (prod-windows-ev), Approvers, and an HSM partition. Step through it to see the policy gate, the approval window, the HSM sign operation, and the audit row that links signature → approver → key → policy. Includes a side panel of what the same policy *blocks* — wrong file types, expired approvals, prod/non-prod mixing.

• Click-through 6-step flow: request → review → approve → submit → HSM sign → audit sealed
• Live audit log that fills in as you progress, mirroring the row CodeSign Protect actually writes
• Toggle to inspect the underlying Signing Template policy (file types, hashes, TSA, approver rules)
• Failure-mode panel: what governance blocks (and why prod/non-prod separation matters)
• Cross-linked from the Venafi CodeSign Protect guide and the existing Code Signing demo

New Guide: Venafi CodeSign Protect — Enterprise Code Signing, Explained

Practitioner deep-dive on Venafi CodeSign Protect (now CyberArk Code Sign Manager): architecture, components, signing flow, CSBR compliance mapping, CI/CD integration, operations, and common pitfalls.

Code signing is the quieter, higher-stakes neighbor of TLS — compromise one signing key and your customers run malware that looks like you. This guide explains how Venafi CodeSign Protect (rebranded CyberArk Code Sign Manager) governs enterprise code signing end-to-end. Covers the four primary objects (Environments, Projects, Code Sign Clients, signing tools), HSM integration and FIPS levels, the full signing flow from signtool to HSM, CI/CD patterns for Azure DevOps / GitHub Actions / Jenkins, a CSBR control-by-control compliance mapping, key rotation and key ceremony operations, and seven common pitfalls — without the marketing fluff.

• Architecture & components: TPP, HSM, Code Sign Clients (Windows CSP/KSP, macOS, Linux PKCS#11, GPG)
• Core concepts: Environments, Projects, Signing Templates, Approvers — the day-to-day vocabulary
• End-to-end signing flow diagram: developer → Code Sign Client → TPP → HSM → audit log
• CSBR compliance mapping table — what the platform covers and what you still own
• Tool integration recipes for signtool, jarsigner, cosign, codesign, and GPG-driven workflows
• CI/CD patterns for Azure DevOps, GitHub Actions, Jenkins, GitLab — including the anti-pattern to avoid
• 7 common pitfalls including prod/non-prod partition separation, missing TSA, and Azure Key Vault EV gotchas

New Guide: ARI Readiness — ACME Renewal Information (RFC 9773)

Implementation guide for the protocol that lets CAs signal emergency certificate renewals. Covers ARI protocol flow, ACME client support comparison, per-client setup, and readiness testing.

After the SSL.com mass revocation and Let's Encrypt drill, this guide answers the practitioner's next question: how do I actually set up ARI in my environment? Step-by-step protocol flow with JSON examples, a 7-client comparison table (Certbot, Caddy, Lego, win-acme, Certify The Web, acme.sh, cert-manager), setup instructions for each client, and a 5-step readiness test.

• ARI protocol flow explained in 5 steps with JSON request/response examples
• 7-client comparison table: ARI polling, replaces field, execution model, emergency response
• Per-client setup: Certbot, Caddy, acme.sh migration path, cert-manager Kubernetes workaround
• 5-step ARI readiness testing checklist
• Connection to shorter certificate lifetimes (47-day automation)

New Blog: 1.7 Million Certificates Revoked in 24 Hours

A deep-dive into the SSL.com mass revocation (1.7M certs, MPIC flaw) and Let's Encrypt's live revocation drill (3M certs) — and why most teams aren't ready for the next one.

Two mass revocation events in two weeks — one accidental, one planned — exposed the same uncomfortable truth: most certificate environments can't respond to "replace everything now" within 24 hours. This post breaks down what happened, explains the ARI protocol that most ACME clients still aren't fully implementing, provides a 5-point readiness checklist, and connects the dots to shorter certificate lifetimes under SC-081v3.

• SSL.com MPIC flaw: 1.7M certificates revoked in 24 hours (April 2, 2026)
• Let's Encrypt first annual mass revocation drill under Mozilla Root Store Policy v3.0
• ARI (RFC 9773) client comparison: Certbot, acme.sh, Caddy, Lego — who's ready and who isn't
• Historical pattern: 2020 CAA bug, 2024 DigiCert DCV incident, 2024 ARI adoption failure (94% didn't respond)
• 5-point mass revocation readiness checklist for your environment
• Connection to SC-081v3 shorter lifetime schedule (200 → 100 → 47 days)

New Blog: The PKI Information Distribution Problem

A deep-dive on why PKI practitioners keep getting blindsided by policy changes — and why the problem is getting worse with shorter certificate lifecycles, more regulatory sources, and post-quantum transitions.

Every significant PKI policy change gets documented somewhere. The CA/Browser Forum publishes ballots. Browser root programs post updates. NIST releases guidance. But there is no single feed that answers "what changed this month that affects my certificates?" This post uses the clientAuth EKU sunset as a case study — three CAs, three different approaches, three different transition timelines, published across three different channels — to illustrate why the distribution problem matters more than ever.

• ClientAuth EKU sunset case study: how DigiCert, Sectigo, and Let's Encrypt each handle the transition differently
• Why shorter certificate lifecycles (47-day) make missed policy changes catastrophic
• The regulatory source explosion: CA/B Forum, Chrome, Mozilla, Apple, Microsoft, NIST, PCI DSS, ETSI
• Post-quantum transition planning as a new monitoring layer
• Three custom infographics: distribution problem diagram, compliance sources map, shrinking margin timeline

New Video Embed

RSA Encryption guide now includes an embedded explainer video.

The RSA Encryption guide now has an embedded YouTube video explaining how RSA works, placed right before the table of contents so readers can watch before diving into the written content.

• RSA Encryption guide: embedded YouTube explainer video

New Checklist: PKI Audit Preparation

A 9-section, 100+ item checklist to prepare for internal or external PKI audits — covering governance documentation, certificate inventory, key management, CA operations, compliance evidence, security controls, automation readiness, and auditor interview prep.

PKI audits fail for predictable reasons: missing governance documents, gaps between inventory and discovery scans, expired CRLs nobody noticed, and team members who can't explain the certificate lifecycle. This checklist addresses every one of those failure modes. It's organized around the nine areas auditors actually examine — from CP/CPS documentation through HSM access logs to interview preparation — with specific evidence artifacts to gather and common findings to preempt. Whether you're facing a SOC 2, PCI DSS, WebTrust, or internal security review, this checklist ensures nothing falls through the cracks.

• 9 audit preparation sections with 100+ actionable items
• Governance documentation verification (CP/CPS, naming conventions, roles)
• Certificate inventory reconciliation against discovery scans
• Key management and HSM evidence gathering
• Compliance evidence artifact checklist (13 specific documents)
• Auditor interview preparation with common questions
• Troubleshooting guide for common pre-audit gaps
• New "Governance" category added to checklists

Site Directory: Every Resource in One Place

New site directory page at /directory lists every guide, demo, tool, checklist, and blog post — giving search engines a single-click path to all content.

Search engines struggle with paginated content behind multiple clicks. The new Site Directory page surfaces all 130+ guides, 50+ demos, tools, checklists, and blog posts on a single page, organized by category. Every resource is now reachable within two clicks from the homepage, improving crawl depth and discoverability.

• All 130+ guides organized by 13 categories
• All 50+ interactive demos organized by 8 categories
• Tools, checklists, runbooks, and blog posts linked
• Footer link added for sitewide access
• SEO meta tags and sitemap entry included

SEO Audit: Meta Descriptions, Titles & Link Fixes

Comprehensive SEO audit fixing 100+ meta descriptions, 10+ page titles, broken internal links, robots.txt improvements, and missing alt text across the site.

Search engines need clear signals to rank your content. We audited every page on FixMyCert and found dozens of meta descriptions under 120 characters, page titles over 60 characters, broken internal links, and missing image alt text. Every issue has been fixed — descriptions now fall in the 120-155 character sweet spot, titles are concise and keyword-rich, and all internal links resolve correctly.

• 100+ meta descriptions expanded to 120-155 characters
• 10+ page titles shortened to under 60 characters
• Broken internal links fixed (learning paths, compliance hub)
• robots.txt updated with proper Disallow rules
• Missing alt text added for enterprise admin images

Dynamic Deadlines — Dates Now Sync from Compliance API

All PKI compliance deadlines across guides, checklists, and badges now pull live dates from the Compliance Hub API. If a deadline shifts, every page updates automatically.

Previously, deadline dates (47-day validity, ClientAuth EKU sunset, PQC migration, DCV method sunsets) were hardcoded across dozens of guide pages and checklists. When a date changed, we had to manually hunt down every reference. Now, a central Compliance Data Provider fetches the latest dates from our Compliance Hub API on page load, caches them locally, and refreshes hourly. Every DeadlineBadge, countdown timer, inline date reference, and checklist milestone automatically reflects the current schedule. The ClientAuth EKU sunset date has also been corrected from June 2026 to March 2027 to match the latest Chrome Root Program update.

• All deadline dates now fetch from the Compliance Hub API automatically
• Local caching with hourly refresh ensures fast page loads
• ClientAuth EKU sunset date corrected to March 2027
• 9 guide/checklist pages updated to use dynamic dates
• Countdown timers in EKU and ClientAuth guides now use live data

New Demo + Guide: RSA Encryption Visualizer

Ever wondered what actually happens when your server decrypts a TLS pre-master secret? Now you can watch it. Type a message, pick a prime pair, and see modular exponentiation encrypt and decrypt each character — step by step.

RSA is the algorithm behind every X.509 key pair, but most engineers treat it as a black box. We built a new interactive demo that lets you choose your own primes, type a message, and watch the math happen character by character — including an expandable square-and-multiply trace for anyone who wants to see exactly how modular exponentiation works under the hood. The companion guide covers the full picture: key generation (all five steps), the one-way factoring problem, how RSA fits into TLS 1.2 key exchange vs TLS 1.3 signatures, padding schemes (OAEP and PSS), key ceremonies, and the quantum horizon. Three new inline graphics walk through the one-way problem, public vs private key roles, and the encrypt/decrypt formulas.

• Interactive RSA demo: type a message, pick primes, watch encryption and decryption live
• Square-and-multiply trace shows every step of modular exponentiation
• Full 8-section guide: from prime generation to the quantum horizon
• Three inline graphics covering the one-way problem, key roles, and RSA formulas
• Covers padding (OAEP, PSS, PKCS#1 v1.5), key ceremonies, and real-world failures
• Added to the Beginner learning path between Encryption Basics and RSA vs ECC

New Guide: Encrypted Client Hello (ECH)

TLS encrypts everything — except the server name you're connecting to. ECH fixes that. This guide covers how it works, why GREASE ECH is already showing up in your logs, and what breaks when you turn it on.

If you run enterprise TLS inspection, you've probably already noticed mysterious ECH extensions in your packet captures. That's GREASE ECH — browsers probing the internet to see if it's safe to encrypt the last piece of plaintext metadata in TLS. This guide walks through the full picture: SNI leakage, ClientHelloOuter vs Inner, the DNS dependency chain, and a practical table of exactly what breaks in enterprise environments.

• Deep dive into SNI leakage and why it matters for privacy
• How ClientHelloOuter and ClientHelloInner work together
• GREASE ECH explained — why browsers send fake ECH extensions
• Enterprise impact table: TLS inspection, DPI, proxies, and more
• March 2026 deployment status across browsers and CDNs
• Action checklist for security teams

Compliance Timeline Redesign: Richer Cards, Better Colors, and "Recently Occurred" Section

The compliance timeline got a visual overhaul — individual deadlines are now distinct cards with status-aware colors, urgency indicators, and a new "Recently Occurred" section so you never miss what just happened

The compliance timeline got a complete visual overhaul. Each deadline is now a distinct card with a bold left accent border color-coded by urgency: orange for deadlines within 60 days, blue for in-progress items, emerald for completed milestones, and slate for standard upcoming events. Urgent deadlines within 30 days get a pulsing red dot and "URGENT" badge, while items within 60 days show a "HIGH" label — so you can scan the timeline at a glance and know exactly what needs attention. The "Recently Occurred" section now has richer emerald-tinted cards with a left green border, and the impact callout has been upgraded to a red-tinted alert bar that really stands out. Every card has more breathing room, hover effects, and better visual hierarchy with larger titles and clearer status badges. We also expanded the "Related Guides" mapping to cover all 65+ deadline IDs from the API, so every single timeline item now links to the right guides and checklists.

• Left accent border cards with status-specific colors: orange (urgent), amber (high), blue (in progress), emerald (completed)
• Pulsing dot indicators with glow rings for urgent and in-progress items
• Countdown labels ("in 14d") on deadlines within 60 days for instant urgency awareness
• Red-tinted "MAJOR IMPACT" alert bars replace subtle inline impact text
• Complete guide mapping for all 65+ deadline IDs — every card links to relevant guides and checklists
• Richer card layout with larger titles, more padding, hover shadows, and rounded pill badges

New Blog: Key Ceremony Best Practices — What Your Script Should Include

A practitioner-level guide to PKI key ceremony scripts covering what to include, what auditors verify, and the common mistakes that create findings

We published a deep-dive blog post on key ceremony scripts — the formal, witnessed process of generating cryptographic keys for a Certificate Authority. This isn't the academic "what is a key ceremony" overview you find elsewhere. It's a practitioner's breakdown of what your script should actually contain: pre-ceremony checklists, HSM operations structure, key backup procedures, witness requirements, and the specific documentation gaps that generate audit findings. The post includes five custom infographics — roles diagram, pre-ceremony checklist flow, ceremony script flow, audit red flags, and common mistakes — plus a video walkthrough. We also added cross-links from 6 related pages (HSM guide, CA Hierarchy guide, What Is a CPS guide, Internal CA CPS blog, and PCI DSS checklist) so readers can discover it naturally.

• Complete ceremony script structure: initialization, HSM operations, key backup, shutdown
• Pre-ceremony checklist: environment, personnel, hardware, and media verification
• What auditors actually look for — the 5 documentation gaps that create findings
• 5 custom infographics: roles, pre-checklist flow, ceremony flow, audit flags, common mistakes
• Video walkthrough embedded at the top of the post
• Cross-linked from 6 related pages across the site for organic discovery

New: DNS-PERSIST-01 Guide + Security Analysis Blog Post

Comprehensive guide to the new persistent ACME DNS validation method (SC-088v3) plus a companion blog post analyzing 5 security assumptions that change with persistent authorization

DNS-PERSIST-01 is the biggest change to ACME certificate validation since DNS-01 was introduced. The CA/Browser Forum approved it unanimously, Let's Encrypt announced support, and production rollout is expected Q2 2026. We published a full guide covering how it works, how it compares to DNS-01, scope controls, security tradeoffs, implementation timeline, and a decision framework to help you decide when to adopt. We also wrote a companion blog post that goes deeper on the security side — five specific assumptions that change when your certificate validation becomes persistent, and what your team should do about each one. Both resources include video walkthroughs.

• Complete DNS-PERSIST-01 guide with 9 sections: problem, how it works, DNS-01 comparison, scope controls, security, timeline, decision framework
• Companion blog post: "DNS-PERSIST-01 Is Great. Your Threat Model Needs Updating."
• Video walkthroughs embedded in both the guide and blog post
• Cross-linked with existing 47-day timeline and DCV methods sunset content
• First-mover content — this is the most comprehensive DNS-PERSIST-01 resource available

Share Checklists & Runbooks with Your Team

All checklists and runbooks now have LinkedIn, X, and copy-link sharing buttons so you can easily send them to colleagues

Every checklist and runbook on FixMyCert now has social sharing buttons built right into the sticky progress bar. Share a checklist with your team on LinkedIn, post it on X, or copy the link to drop into Slack or email. This was one of the most requested features — when you find a checklist that solves a real problem, you should be able to share it in two clicks.

• LinkedIn, X (Twitter), and copy-link buttons on every checklist and runbook
• Buttons live in the sticky progress bar so they're always accessible
• One-click copy to clipboard for easy sharing via Slack, email, or Teams

New: 47-Day Readiness Audit Checklist (82-Point Assessment)

A structured audit to assess whether your PKI infrastructure is ready for 47-day certificate validity — covering automation, DCV, monitoring, and team readiness

With the March 15, 2026 Phase 1 deadline approaching, we built a comprehensive 82-point readiness audit that walks you through every area that matters: certificate discovery, renewal ownership, DCV readiness, ACME pipelines, deployment automation, monitoring, and organizational preparedness. Unlike a generic compliance checklist, this one is specifically designed around the SC-081v3 timeline. It includes a built-in readiness scoring guide so you can quickly assess where you stand — Ready, On Track, At Risk, or Critical — and prioritize accordingly. We also completely rewrote the F5 BIG-IP SSL Certificate Checklist with 52 items covering tmsh commands alongside GUI steps, PFX conversion instructions, chain warnings, and a full FAQ section.

• 82-point audit across 9 sections: inventory, DCV, ACME, deployment, monitoring, and more
• Phase 1 countdown context with March 15, 2026 deadline awareness
• Built-in readiness scoring: Ready / On Track / At Risk / Critical
• F5 SSL Checklist completely rewritten with 52 items, tmsh commands, and FAQ
• Both checklists feature interactive progress tracking with localStorage persistence

The PKI Automation Gap: Why Nobody Is Ready for 47-Day Certificates

An honest, vendor-neutral assessment of where certificate automation actually fails — and what to prioritize before the 200-day deadline hits

New pillar guide tackling the uncomfortable truth about 47-day certificates: most organizations aren't ready, and many don't even know where the gaps are. This guide walks through the entire 5-stage certificate lifecycle pipeline — discovery, validation, issuance, deployment, and monitoring — and shows exactly where automation breaks down at each stage. It's vendor-neutral by design, focusing on the real operational challenges rather than pushing any particular CLM product. Whether you're just starting to plan for SC-081v3 or you've already begun automating, this guide helps you identify blind spots and prioritize what matters most before the March 2026 enforcement date.

• 5-stage pipeline breakdown: discovery, validation, issuance, deployment, monitoring
• Vendor-neutral assessment — no product pitches, just honest gap analysis
• Prioritization framework for what to automate first
• Covers SC-081v3 timeline from 200-day to 47-day validity
• Actionable guidance for teams preparing for March 2026 enforcement

Digital Signatures Guide: Embedded Video Walkthrough

The Digital Signatures pillar guide now includes an embedded video explaining how digital signatures work

The Digital Signatures guide now features an embedded video walkthrough right at the top of the page. This video complements the written content by visually explaining how digital signing and verification work using cryptographic hashing and asymmetric key pairs. Whether you're new to PKI or brushing up on fundamentals, the video provides a quick, accessible overview before diving into the detailed written guide.

• Embedded YouTube video walkthrough at the top of the Digital Signatures guide
• Responsive 16:9 video player that works on all screen sizes
• Visual complement to the existing written guide content

Azure Key Vault Certificates: The Comprehensive Lifecycle Guide

Import, generate, renew, and troubleshoot certificates in Azure Key Vault — with automation patterns for App Gateway, AKS, and API Management

New guide covering Azure Key Vault certificate management end-to-end. Includes a Golden Path quick-start that gets you from a PFX file to App Gateway TLS termination in four commands. Three labeled automation patterns (ACME → Key Vault, Corporate CA → Key Vault, and Event-driven renewal) give you concrete starting points for your pipelines. A defaults-vs-recommended table covers key algorithm, validity period, content type, and EKU configuration. Troubleshooting decision trees now include CLI quick-check commands you can paste directly into your terminal. Full examples for API Management setup and an AKS SecretProviderClass YAML with workload identity.

• Golden Path: 4-command workflow from PFX to App Gateway TLS termination
• Automation Patterns: ACME, Corporate CA, and Event-driven renewal workflows
• Defaults vs Recommended table with EKU guidance for TLS server auth
• CLI Quick Checks: paste-ready commands after every troubleshooting tree
• AKS SecretProviderClass YAML with workload identity (current best practice)
• API Management setup with managed identity and RBAC
• Embedded video walkthrough at the top of the guide

Consistent Hero Layouts Across All Content

Every guide and demo now has the same polished, professional hero section

We've standardized the layout across all 124 guides and 52 demos with new GuideHero and DemoHero components. Every page now features consistent breadcrumbs, back navigation, copy-to-clipboard functionality, and beautiful hero images. This isn't just about aesthetics—it's about making FixMyCert feel like a cohesive platform rather than a collection of individual pages. Whether you're reading about OpenSSL commands or exploring certificate transparency logs, you'll always know exactly where you are and how to navigate.

• Unified hero sections: same structure, same functionality, every page
• Smart back links: demos link to the demo index, guides to their category
• Copy content dropdown: share any guide or demo with one click
• Consistent tag colors: amber, blue, purple, green, red, gray
• Mobile-responsive: hero sections look great on any device

TLS-ALPN-01 Automation Guide

Prove domain control inside the TLS handshake—no files, no DNS, just TLS

Port 80 blocked? No DNS API? Port 443 is your answer. TLS-ALPN-01 proves domain control during the TLS handshake itself, making it the perfect fit for reverse proxy environments where HTTP-01 and DNS-01 aren't practical. This guide covers RFC 8737 requirements, step-by-step implementations for Caddy, Traefik, lego, and acme.sh, plus the troubleshooting patterns that save you hours of debugging ALPN negotiation failures.

• RFC 8737 deep dive: how the acme-tls/1 protocol works
• Caddy: zero-config TLS-ALPN-01 with automatic fallback to HTTP-01
• Traefik: tlsChallenge configuration with durable storage patterns
• lego & acme.sh: standalone mode and zero-downtime HAProxy integration
• IPv6 gotchas: why mismatched AAAA records break validation
• Comparison table with "Primary Failure Mode" for ops intuition

Automating DNS-01 with DNS APIs

Complete guide to secure DNS-01 automation with CNAME delegation and provider-specific configurations

DNS-01 validation unlocks wildcards, internal servers, and multi-node deployments—but storing DNS API credentials on web servers is a security nightmare. This guide shows you how to implement DNS-01 automation the right way: using CNAME delegation to separate your primary zone from validation credentials. Whether you're using Cloudflare, Route53, Azure DNS, or Google Cloud DNS, you'll find provider-specific configurations and the security patterns that enterprise PKI teams actually use.

• CNAME delegation pattern: keep DNS credentials off production servers
• Provider configs: Cloudflare, Route53, Azure DNS, Google Cloud DNS
• acme-dns setup: purpose-built DNS server for ACME challenges
• Propagation timing: know how long to wait for each provider
• Wildcard + apex certificates: handling multi-value TXT records
• Security checklist: credential rotation, CAA records, and monitoring

Automating HTTP-01 on Nginx, Apache, and IIS

The simplest path to automated certificates for single-server deployments

HTTP-01 is the most straightforward ACME validation method—no DNS APIs, no complex delegation, just serve a file over port 80. This guide covers Nginx, Apache, and IIS configurations for Certbot and win-acme, plus the operational patterns that keep automated renewals running smoothly. If you're running a standard web server and can expose port 80, HTTP-01 gets you from manual renewals to full automation in under an hour.

• Nginx: webroot, standalone, and nginx plugin configurations
• Apache: Certbot module integration and .htaccess patterns
• IIS/Windows: win-acme and Posh-ACME for automated renewals
• Pre/post hooks: restart services and reload configurations
• Production hardening: monitoring, alerting, and failover strategies

Which DCV Method Should You Automate?

Decision framework for choosing between HTTP-01, DNS-01, and ALPN-TLS-01 automation

With the CA/Browser Forum sunsetting 11 DCV methods by 2028, automation isn't optional anymore—it's mandatory. But which method should you automate? This guide provides a clear decision algorithm: start with your environment constraints (wildcard needs, port 80/443 access, DNS API availability), then factor in operational complexity and multi-CA flexibility. Whether you're running Kubernetes, managing 10,000+ domains, or just getting started with ACME, you'll find your path.

• Visual flowchart: follow the decision tree to your ideal DCV method
• Decision algorithm: step-by-step if/then logic for method selection
• Side-by-side comparison of HTTP-01, DNS-01, and ALPN-TLS-01
• Scenario matrix: find your exact use case and recommended approach
• Enterprise pattern example: 500-domain financial services deployment
• Migration priority guidance: what to automate first

Caddy SSL Certificate Configuration Guide

Automatic HTTPS that just works—and what to do when it doesn't

Caddy is famous for its zero-config TLS, but "automatic" doesn't mean "no questions." This comprehensive guide covers everything from the magic of automatic HTTPS to manual certificate configuration, mTLS client authentication, DNS challenges for wildcards, Docker deployment with persistent volumes, and troubleshooting common issues like Cloudflare orange-cloud conflicts. Whether you're deploying Caddy as a reverse proxy or edge TLS terminator, this guide has you covered.

• Automatic HTTPS explained: what Caddy does by default and the requirements
• Reverse proxy with health checks and load balancing
• Manual certificates for enterprise PKI and wildcards
• mTLS client authentication with trust bundle options
• ACME configuration: staging CA, DNS challenges, ZeroSSL
• New section: Disabling or restricting automatic HTTPS
• Docker-compose setup with persistent certificate storage
• Comparison table: Caddy vs nginx vs Apache for TLS offload

The 47-Day Certificate Timeline Guide

Understand the CA/Browser Forum ballot that will reshape your certificate renewal strategy by 2029

SC-081v3 was announced on April 12, 2025, passing with a unanimous 29-0 vote. It's reducing TLS certificate validity from 398 days to just 47 days by March 2029. If you own PKI, certificates, or TLS standards internally, this is now on your roadmap. This guide breaks down the three-phase timeline, explains the dramatic impact on domain validation (from ~4 to ~35 validations per year), and gives both PKI engineers and security managers concrete action items to prepare.

• Live countdown timers to all three phase deadlines (March 2026, 2027, 2029)
• Full timeline breakdown: certificate validity and DCV reuse at each phase
• PKI Engineering section: what changes in your stack (ACME, DNS-01, automation)
• Security Manager section: ownership, budgeting, and policy deadlines
• The DCV reuse problem: why 10-day validation reuse is the real challenge
• Clear callout: private PKI is NOT affected by this ballot

PCI DSS 4.0 Certificate Audit Prep Checklist

Know exactly what your QSA will ask about certificates and encryption—before the audit starts

PCI DSS 4.0 is now mandatory, and Requirement 4 (protect cardholder data in transit) has stricter cipher and forward secrecy requirements. This comprehensive checklist walks you through scoping, evidence collection, common findings to fix before the QSA arrives, and the exact interview questions you'll face. We've also included a 30-day timeline so you can systematically prepare instead of scrambling.

• Requirement 4.2.1 mapping: protocols, ciphers, and key strength requirements
• Evidence collection checklists: what to gather before the QSA arrives
• Common findings and how to fix them: TLS 1.0, weak ciphers, missing chains
• QSA interview prep: the certificate, crypto, and key management questions they ask
• Requirement 12.3.3: the new cryptographic inventory requirement
• 30-day audit prep timeline: systematic preparation, not last-minute panic

SSL Labs A+ Checklist

Your step-by-step path to a perfect SSL Labs score—no guesswork required

Got a B or C on SSL Labs and not sure what's wrong? This actionable checklist walks you through everything: certificate requirements, protocol configuration, cipher suite ordering, and the magic ingredient for A+ (hint: it's HSTS with a long max-age). We've also catalogued the common pitfalls that kill grades—missing intermediates, legacy TLS protocols, weak DH parameters—so you can fix them systematically.

• Certificate requirements: chain, key size, signature algorithm
• Protocol configuration: TLS 1.2/1.3 only, disable legacy versions
• Cipher suite ordering: forward secrecy first, no weak ciphers
• HSTS configuration: the A→A+ upgrade everyone forgets
• Common pitfalls that kill grades and how to fix them
• Quick test workflow for iterating to A+

F5 SSL Passthrough vs Offloading vs Bridging

Choose the right SSL termination strategy for your F5 BIG-IP deployment with this clear comparison guide

One of the most common questions from F5 administrators: "Should I use passthrough, offloading, or bridging?" This guide answers that question definitively with a clear comparison table, decision flowchart, and configuration examples for each approach. You'll understand the trade-offs between end-to-end encryption, L7 features, and WAF protection—plus common mistakes that trip up even experienced engineers.

• Quick comparison table: see all three modes at a glance
• Decision flowchart: pick the right mode in 30 seconds
• Configuration examples for passthrough, offloading, and bridging
• Common mistakes: cookie persistence with passthrough, missing HTTP profiles
• tmsh commands for converting between modes

OpenSSL FIPS Compliance Guide

Finally understand what FIPS 140 actually requires—and how to implement it correctly with OpenSSL 3.x

Most organizations confuse "FIPS capable" (a marketing term) with "FIPS compliant" (an audit-defensible claim). This comprehensive guide clarifies the critical distinction and provides everything you need: OpenSSL 3.x provider architecture explained, openssl.cnf configuration templates, algorithm approval tables, Security Policy boundary requirements, common implementation mistakes, and a complete audit checklist. Whether you're preparing for FedRAMP, DoD, or just want to get FIPS right, this guide has you covered.

• FIPS Capable vs Compliant: The critical distinction auditors care about
• OpenSSL 3.x provider architecture with FIPS module loading
• Algorithm restriction tables: what's approved vs blocked
• Security Policy boundaries and operational constraints
• Enterprise patterns: Ansible, CI/CD verification, startup checks
• Complete audit documentation checklist

Compliance Framework Guide Series

Six comprehensive guides mapping DORA, NIS2, NIST, NSA CNSA 2.0, UK CSR Bill, and CA/Browser Forum to certificate lifecycle management

Understanding compliance requirements for PKI shouldn't require deciphering dense regulatory text. We've built a complete Compliance Framework Series with six guides that translate regulatory language into actionable CLM controls. Whether you're preparing for DORA audits, implementing NIS2's cryptography requirements, planning your CNSA 2.0 post-quantum transition, or aligning with UK CSR Bill expectations—each guide includes requirement mapping tables, implementation checklists, and cross-references to help you demonstrate compliance. Non-NSS organizations can also use the CNSA 2.0 guide as a high-water mark for PQ readiness planning.

• DORA: 5 pillars mapped to CLM capabilities with 10-minute auditor self-assessment
• NIS2: Article 21 cryptography requirements with ENISA/ETSI algorithm guidance
• NIST: SP 800-57/52/131A guidelines mapped to practical certificate controls
• NSA CNSA 2.0: Post-quantum transition timeline with ML-KEM, ML-DSA requirements
• UK CSR Bill: NCSC CAF alignment, MSP regulatory exposure, board-level metrics
• CA/Browser Forum: Ballot process, validity reduction timeline (47 days by 2029)

What is the CA/Browser Forum? Complete Guide

Understand who makes the rules for publicly-trusted certificates and why their decisions affect your PKI

Ever wondered who decides certificate validity periods or why your CA suddenly has new requirements? The CA/Browser Forum is the industry consortium where Certificate Authorities and browser vendors collaborate on the rules governing publicly-trusted certificates. This guide explains who's at the table, how ballots become requirements, and why browser vendors hold the real power. We've added dynamic timelines showing 2025 changes already in effect and major upcoming deadlines, plus enterprise impact callouts so you know exactly how load balancers, appliances, and legacy systems will be affected.

• Who participates: CAs (DigiCert, Sectigo, Let's Encrypt) vs browsers (Chrome, Firefox, Safari, Edge)
• How changes happen: Ballot process from proposal to 6-18 month implementation
• Power dynamics: Why browsers can distrust CAs unilaterally (see Entrust)
• Dynamic 2025 Changes table: MPIC, pre-issuance linting, SHA-1 sunset already in effect
• Upcoming deadlines: Validity reductions from 200 days (Mar 2026) to 47 days (Mar 2029)
• Enterprise impact callouts: Load balancers, appliances, vendor-managed devices need automation

DORA & Certificate Management Guide

Map EU financial regulation to certificate lifecycle management for compliance readiness

The EU's Digital Operational Resilience Act (DORA) is now in effect, and financial services firms need to demonstrate operational resilience across all ICT systems—including certificates. This guide maps DORA's five pillars to concrete CLM capabilities, so you know exactly what auditors will ask about your certificate management. We've included a "10-Minute Auditor Test" self-assessment linked to our Maturity Assessment, a 4-phase implementation roadmap, and country-level enforcement considerations for Germany, France, Netherlands, Ireland, and UK dual compliance.

• Five DORA pillars mapped to certificate touchpoints: risk management, incident reporting, resilience testing, third-party risk, information sharing
• CLM capability mapping tables for Articles 5-44 with links to relevant guides and runbooks
• 10-Minute Auditor Test: 8-point self-assessment checklist for certificate visibility
• 4-phase implementation roadmap: Discovery → Documentation → Automation → Testing
• Country-level enforcement: BaFin, ACPR/AMF, DNB/AFM, CBI, and UK FCA/PRA focus areas
• Related frameworks comparison: NIS2, UK CSR Bill, NIST CSF 2.0

Certificate Request Form: Enterprise PKI Fields

New fields for CAB approval tracking, key generation location, and CSR submission

The Certificate Request Form just got a major upgrade for enterprise PKI teams. You can now specify the certificate usage profile (Server TLS, Client Auth, Code Signing), select your CA source (internal PKI, public CA, or cloud), and track CAB approval IDs for compliance. Indicate where the key will be generated (HSM, server, or requester workstation), choose your integration method (auto-install, manual, or CLM pickup), and paste the CSR directly into the form. For renewals, link back to the existing certificate for audit trails.

• Certificate Usage/EKU Profile: Server TLS, Client Auth, Code Signing checkboxes
• CA/Issuing Source: Internal PKI, public CA, or cloud CA selection
• CAB Approval ID: Track change advisory board approvals
• Key Generation Location: HSM, server-side, or requester workstation
• CSR Content: Paste CSR directly when requester generates the key
• Renewal tracking: Link to existing certificate thumbprint

PKI Governance Maturity Assessment

Discover your certificate management maturity level in 5 minutes with personalized recommendations

Where does your organization stand on the PKI governance spectrum? Our new interactive assessment answers that question with 18 targeted questions across 6 key areas: inventory visibility, lifecycle management, process documentation, automation, compliance readiness, and incident response. In about 5 minutes, you'll get a maturity score (1-5), see exactly which areas need attention, and receive prioritized recommendations linking to the specific FixMyCert tools that can help. Share your results with stakeholders, track progress over time, and build the business case for PKI investments.

• 18 questions across 6 categories covering full PKI governance spectrum
• 5 maturity levels: Ad-Hoc, Reactive, Defined, Managed, Optimized
• Visual category breakdown showing your strengths and gaps at a glance
• Prioritized recommendations with links to relevant tools and guides
• Share results via URL or copy to clipboard for stakeholder reports
• Review and change answers before submitting—no penalty for second thoughts

IIS SSL Certificate Configuration Guide

Complete Windows Server IIS SSL setup from CSR to A+ grade

Windows admins, this one's for you. Our new IIS guide covers everything from generating CSRs in IIS Manager or PowerShell, through certificate installation and SNI bindings, to TLS hardening and SSL Labs A+ optimization. Whether you're managing a single site or a web farm with Centralized Certificate Store, you'll find step-by-step instructions with both GUI and PowerShell approaches. The troubleshooting section tackles the infamous "Cannot find the certificate request" error and five other headaches we've all encountered.

• CSR generation: IIS Manager GUI and certreq with SANs
• Certificate installation: Complete request, PFX import, and intermediate chains
• SNI bindings: Host multiple sites on one IP with SslFlags configuration
• TLS hardening: IIS Crypto tool, PowerShell registry, and Group Policy methods
• Centralized Certificate Store: Web farm certificate management
• 6 common issues: Private key problems, binding errors, chain issues with fixes

Compliance Hub: Live Ballot Voting Status

Track CA/B Forum ballot progress in real-time with voting countdowns and status badges

Wondering if that new certificate requirement is actually going to happen? Now you can follow CA/Browser Forum ballots through their entire lifecycle right in the Compliance Hub. When a ballot enters the voting phase, you'll see an amber "Voting" badge with a countdown showing exactly how many days remain. Once passed, a green "Passed" badge appears with a countdown to the enforcement date. No more checking mailing lists or forum archives—the status comes to you.

• Voting countdown: See exactly when ballot voting ends and track progress in real-time
• Passed status: Green badge with countdown to enforcement date so you know your runway
• Proposed visibility: Purple badge for ballots still under discussion (early warning)
• SC-097 tracking: Follow the 47-day certificate validity ballot through its voting period

Traefik SSL Certificate Configuration Guide

Automatic HTTPS for your containers and Kubernetes services with Traefik

Running containers and need SSL? Traefik makes it almost too easy—automatic Let's Encrypt certificates, Docker label configuration, and Kubernetes IngressRoute support. Our new guide covers everything from zero-config ACME automation to manual certificate handling for enterprise PKI environments. Whether you're spinning up a Docker Compose stack or managing a Kubernetes cluster, you'll find the exact YAML snippets and troubleshooting tips you need.

• Let's Encrypt automation: HTTP-01, TLS-ALPN-01, and DNS-01 challenge configuration
• Docker Compose examples: Full stack configs with labels for automatic SSL
• Kubernetes IngressRoute: TLS with cert resolvers and Kubernetes Secrets
• Manual certificates: File-based configuration for corporate CAs and wildcards
• TLS hardening: Cipher suites, minimum versions, HSTS middleware
• Troubleshooting: ACME failures, certificate mismatches, chain issues
• Quick reference: Docker labels cheat sheet and minimal setup templates

Compliance Hub: Algorithm Deprecation Tracking & Proposed Ballot Visibility

New filtering for crypto migration deadlines and early warning on CA/B Forum ballots still under discussion

Two enhancements to the PKI Compliance Hub make it easier to track what matters to you. Algorithm deprecation deadlines—like RSA key size changes and cipher suite sunsets—now have their own category so you can filter specifically for crypto migration timelines. And when a CA/Browser Forum ballot is still under discussion, you'll see a purple "Proposed" badge giving you early warning before requirements become mandatory. Stay ahead of the curve instead of reacting after the fact.

• Algorithm Deprecation category: Filter specifically for RSA/ECC migration timelines and cipher suite changes
• Proposed badge: Early visibility into CA/B Forum ballots before they pass
• Better planning: See what's coming while you still have time to prepare
• Cleaner filtering: Focus on the compliance areas that matter to your infrastructure

SSH Certificate Series Complete - 5 Guides from Fundamentals to Enterprise

Master SSH certificates from DIY to enterprise-scale with our complete 5-part guide series

Managing SSH access across hundreds of servers with authorized_keys files? There's a better way. Our complete SSH Certificate series takes you from understanding why certificates beat keys, through hands-on CA setup, to enterprise-grade certificate management with Venafi. Whether you're an SRE eliminating key sprawl or a security architect planning an enterprise rollout, you'll find actionable guidance with real OpenSSH commands you can use today.

• SSH Certificates fundamentals: Why certificates beat keys for access management
• SSH User Certificates: Eliminate authorized_keys files across your fleet
• SSH Host Certificates: Kill TOFU prompts with cryptographic host identity
• SSH Certificate Authority Setup: Build your own CA with OpenSSH in 30 minutes
• Venafi SSH Protect: Enterprise SSH certificate management at scale
• Practical config snippets: TrustedUserCAKeys, sshd_config, SSH config stanzas
• Migration playbook: Parallel CA operation, phased rollout, real-world example
• Decision framework: When DIY is enough vs. when you need enterprise tooling

Compliance Framework Mapping Enhanced

Clearer scope definitions and practical audit guidance for mapping PKI controls to compliance frameworks

• Methodology statement clarifying "supporting evidence" vs. full compliance
• Two-Layer Model table: Your policies + FixMyCert procedures = audit-ready
• Scope statements for all 6 frameworks (PCI DSS, SOC 2, ISO 27001, NIST, CIS, CA/B Forum)
• Enterprise fields table: Internal Doc Link, Control ID, Owner, Reviewer, Review dates
• FAQ section addressing common compliance questions
• Enhanced disclaimer with explicit PKI/TLS scope

Apache SSL Certificate Configuration Guide

Get HTTPS running on Apache with mod_ssl - from first setup to production-hardened configurations

You're configuring SSL on Apache and need to know exactly which directives go where. Our new Apache guide covers everything from enabling mod_ssl to production-ready HSTS and OCSP stapling. Whether you're on Debian/Ubuntu or RHEL/CentOS, you'll find distro-specific commands, the critical Apache 2.4 vs 2.2 differences, and a go-live checklist to make sure you haven't missed anything. This completes our Web Servers trifecta alongside nginx and HAProxy.

• Distro-specific commands for Debian/Ubuntu and RHEL/CentOS
• Apache 2.4 vs 2.2 key differences (chain file handling, OCSP stapling)
• Production-hardened config with Mozilla generator cipher suites
• HTTP to HTTPS redirect using Redirect and mod_rewrite
• SNI setup for multiple SSL sites on one IP
• Let's Encrypt with Certbot auto-configuration
• File permissions checklist (600 on private keys)
• Troubleshooting section: certificate/key mismatch, chain issues, SSL Labs grade fixes
• Pre-deployment checklist for going live

CSR Rejection Reasons Guide

Stop guessing why your CA rejected your certificate request - get the fix for every common CSR failure

You submitted a CSR and got a rejection email with minimal explanation. Now what? Our new guide covers every reason CAs reject certificate signing requests - from obvious issues like wrong key size to obscure problems like the Debian weak keys disaster (2006-2008). Each rejection category includes practical fixes with OpenSSL commands you can copy and run. Whether your CSR failed for domain issues, formatting problems, rate limits, or validation failures, you'll find the answer here.

• Key-related rejections: size requirements, weak keys, compromised keys, signature algorithms
• Domain-related rejections: internal names, IP addresses, wildcard restrictions, CAA blocking
• Formatting rejections: PEM encoding, key mismatch, invalid characters
• CA-specific rejections: rate limits, high-risk domains, subscriber agreements
• OV/EV validation failures and how to fix them
• Prevention checklist with pre-submission validation steps
• Quick reference table: error messages mapped to causes and fixes
• OpenSSL one-liner for generating a correct CSR from scratch

Certificate Subscriber Obligations Guide

Find out what you actually agreed to when you clicked 'I Accept' on that certificate request

Every time you request a certificate from a public CA, you're signing a binding contract. Many people click through without reading - then are surprised when their certificate gets revoked. Our new guide breaks down the six core obligations you agreed to: private key protection (warranties typically state it has NEVER been compromised), information accuracy (ongoing, not one-time), authorized and legal use, no CA operations, prompt revocation reporting, and indemnification. We cover DV/OV/EV differences, prohibited uses, real-world violation scenarios, and how to stay compliant.

• Six core subscriber obligations explained with actual CPS language
• Private key protection is absolute - you warrant it has NEVER been compromised
• Continuous accuracy obligation - you must monitor and report changes within 24h
• DV vs OV vs EV obligation differences
• Prohibited uses table (nuclear, weapons, air traffic control)
• Four real-world violation scenarios with consequences
• How to stay compliant - individual and organizational checklists
• Links to major CA subscriber agreements (DigiCert, Sectigo, Let's Encrypt, etc.)
• FAQ: inherited certs, free certs, name changes, dev environments

Certificate Revocation Requirements Guide - Expert Edition

Master CA/Browser Forum revocation rules with PKI Pro summaries, OCSP/CRL tuning tables, and role-specific guidance

When Entrust refused to revoke 26,000+ certificates within the required timeframe in 2024, browsers responded by distrusting them entirely. Our comprehensive guide now includes expert-level enhancements: a PKI Pro Quick Scan for experienced practitioners, explicit BR section references (4.9.1.1, 4.9.5), concrete "suspected compromise" scenarios, OCSP/CRL cache tuning recommendations, mass revocation planning guidance per SC088/SC089, and team role tags (PKI/Infra, Security Ops, App Teams) so everyone knows what applies to them. Whether you're a PKI administrator or security engineer, this is the definitive resource for understanding certificate revocation timelines and compliance.

• PKI Pro Quick Scan: 60-second summary for experienced practitioners
• Two-tier timeline with explicit BR section references (4.9.1.1, 4.9.5)
• Concrete suspected compromise scenarios: HSM anomalies, server breach, key exfiltration
• OCSP/CRL cache tuning table with practical recommendations
• Mass revocation planning guidance per CA/Browser Forum SC088/SC089
• Private vs public CA comparison sidebar
• Team role tags: PKI/Infra, Security Ops, App Teams
• Mozilla delay framing: documented, time-bounded plans required
• New FAQs: mass revocation, partial SAN impacts, private CA applicability

Certificate Decoder Tool + Tools Landing Page

Decode any PEM certificate instantly and discover all our PKI tools in one place

• New Certificate Decoder: paste a PEM cert and see subject, issuer, validity, SANs, key details, and fingerprints
• Visual expiry status: green (valid), yellow (expiring soon), red (expired)
• Copy fingerprints with one click for verification
• New /tools landing page with all PKI utilities in one place
• Tools now accessible directly from the navbar
• Consistent "Back to Tools" navigation across all tool pages

HAProxy SSL Certificate Configuration Guide

Configure SSL/TLS in HAProxy like a pro—from basic termination to A+ SSL Labs rating

HAProxy powers some of the internet's busiest sites (GitHub, Stack Overflow, Reddit), but its SSL configuration can be tricky—especially the PEM file format that combines cert, chain, and key in one file. Our new 15-section guide walks you through all three SSL modes (termination, passthrough, re-encryption), shows you exactly how to achieve an A+ SSL Labs grade, and includes troubleshooting for the most common errors. Whether you're setting up your first HAProxy instance or debugging "unable to load SSL certificate" at 2am, this guide has you covered.

• Three SSL modes explained: Termination, Passthrough, and Re-encryption with traffic flow diagrams
• HAProxy PEM format demystified: cert + chain + key in the right order
• Production-ready config: Modern cipher suites, HSTS, and security headers for A+ grade
• SNI configuration for multiple domains on one IP address
• OCSP stapling and mTLS (client certificate authentication) setup
• Let's Encrypt automation with renewal hooks and HTTP-01 challenge routing
• Troubleshooting section with common errors and debug commands

Copy Content for AI Assistants & Markdown Export

Share any guide with AI tools or save as clean Markdown with one click

We've added a "Copy" button to every guide, checklist, and educational page on the site. Click it to copy the content in two formats: clean Markdown (preserving headers, code blocks, and lists) or a special AI-optimized version with source attribution. The AI format strips out interactive elements and includes context so ChatGPT, Claude, or your favorite assistant knows exactly where the information came from. Perfect for pasting PKI documentation into your AI conversations or saving guides for offline reference.

• Two copy modes: Markdown (for docs/notes) and AI Assistant (with source context)
• Smart formatting: Card grids become bullet lists, Pros/Cons get proper structure
• Interactive elements stripped in AI mode—no buttons, forms, or demo controls
• Works on all 90+ guides, 10 checklists, ADCS deep dives, and case studies
• Related Resources formatted as clean clickable links

AWS ACM Deep Dive + Troubleshooting Guide

Master AWS ACM and fix certificate issues fast with our two-part guide set

AWS ACM offers free SSL certificates, but there's a catch: they only work with certain AWS services, the private keys can't be exported, and if you're using CloudFront, your certificate MUST be in us-east-1. We've created two companion guides: a comprehensive deep dive covering ACM vs alternatives, validation methods, and Private CA, plus a fast-reference troubleshooting guide with jump links so you can fix "pending validation", renewal failures, and the us-east-1 CloudFront trap in minutes.

• The us-east-1 CloudFront requirement everyone hits at least once
• ACM vs Let's Encrypt vs commercial CAs decision tree
• Jump links to common issues: pending validation, can't delete, CAA errors
• Quick diagnostic commands cheatsheet for CLI troubleshooting
• Complete CLI reference for certificate management
• 15 FAQ questions with structured data for Google rich results

Extended Key Usage (EKU) Guide & Migration Checklist

Understand what your certificates are authorized to do—and prepare for the June 2026 ClientAuth deadline

Ever wondered why a code signing certificate can't secure your website? It's all about Extended Key Usage (EKU)—the certificate extension that acts like a job description, telling systems exactly what each certificate is allowed to do. Our new 10-minute EKU guide breaks down the OID system, shows you how to check any certificate's permissions, and explains why the industry is separating ServerAuth from ClientAuth. Plus, a comprehensive 4-phase migration checklist with a live countdown timer to help you prepare before Chrome's June 2026 enforcement deadline.

• Complete EKU reference: ServerAuth, ClientAuth, CodeSigning, EmailProtection, TimeStamping, OCSP Signing
• OID system explained: Break down 1.3.6.1.5.5.7.3.1 and understand the hierarchical naming
• Live countdown timer: See exactly how much time remains until the June 2026 deadline
• 4-phase migration checklist: Discovery, Planning, Implementation, and Production Cutover
• New glossary entries for EKU and OID with cross-links to related content

Client Authentication EKU Sunset Guide

Prepare for Chrome's June 2026 deadline before your mTLS stops working

Chrome is removing Client Authentication EKU from public TLS certificates by June 2026—and DigiCert and Sectigo are already phasing it out. If you use public certs for mTLS or server-to-server authentication, this guide walks you through the timeline, helps you understand your options (Private PKI, PKI-as-a-Service, or the new X9 PKI for financial services), and provides a 4-phase migration checklist to get you ready before the deadline.

• Complete timeline: Chrome June 2026 hard enforcement, DigiCert/Sectigo removal dates
• Four migration options explained: Private PKI, PKIaaS, X9 PKI, and separate certificate types
• Migration checklist: Discovery, Planning, Implementation, and Cutover phases
• F5 BIG-IP specific guidance for Client SSL profile migrations
• Dynamic countdown showing months remaining until enforcement

Site-Wide Search is Here

Find any guide, demo, or checklist instantly with Cmd+K

With 92 guides, 51 demos, and 9 checklists, finding exactly what you need was getting harder. Now you can press Cmd+K (or Ctrl+K on Windows) from anywhere on the site to search everything instantly. Type "mTLS" and jump straight to the mutual TLS guide, or search "expired" to find troubleshooting content. We've even added PKI-specific synonyms so searching "SSL" also finds TLS content.

• Keyboard shortcut: Cmd+K (Mac) or Ctrl+K (Windows) from any page
• 152 searchable records across all guides, demos, and checklists
• PKI-aware synonyms: SSL/TLS, cert/certificate, ADCS, Venafi, and more
• Instant results with keyboard navigation (↑↓ arrows, Enter to select)

The Venafi Series: Enterprise CLM Guides

Master certificate lifecycle management with vendor-neutral guides written by practitioners, not sales teams

Venafi has had three owners in two years (Thoma Bravo → CyberArk → pending Palo Alto), making honest information harder to find than ever. We've launched The Venafi Series—4 comprehensive guides that cut through the marketing to give you practical knowledge for evaluating, deploying, and operating enterprise CLM. From platform fundamentals to NMAP reconnaissance techniques that turn 12-hour discovery scans into 30-minute jobs.

• What is Venafi? Platform overview, ownership history, and honest assessment
• Certificate Discovery: Network scanning, agents, and the self-signed certificate challenge
• Agent vs Agentless: Trade-offs and real-world hybrid deployment patterns
• NMAP Reconnaissance: Pre-discovery workflow that dramatically reduces scan times

Post-Quantum Cryptography Guide & Migration Checklist

Prepare your PKI for the quantum computing era with our comprehensive PQC resources

The quantum clock is ticking—NIST has finalized the first post-quantum standards (FIPS 203-206) and set hard deadlines: deprecate vulnerable algorithms by 2030, remove them entirely by 2035. Our new comprehensive PQC guide explains the "harvest now, decrypt later" threat, walks through all four NIST algorithms (ML-KEM, ML-DSA, SLH-DSA, FN-DSA), and includes a dynamic timeline that updates automatically to show where we are in the transition. Pair it with our 142-checkbox migration checklist covering Discovery through Production deployment.

• 15-minute comprehensive guide covering quantum threats and NIST solutions
• Interactive timeline showing 2024-2035 milestones with auto-updating "NOW" indicator
• Algorithm comparison cards for ML-KEM, ML-DSA, SLH-DSA, and FN-DSA
• 142-checkbox migration checklist across 4 phases: Discovery, Planning, Testing, Production

SSL/TLS Configuration Checker Tool

Check any website's SSL configuration without leaving FixMyCert

Happy New Year! We're shipping the SSL/TLS Configuration Checker—enter any domain and instantly see the grade, certificate details, protocol support, and security features. Powered by Qualys SSL Labs API, it shows what's working and flags what needs fixing (deprecated TLS versions, missing HSTS, etc). Links to relevant FixMyCert guides help you fix any issues you find.

• Grade display with color coding (A+ green to F red)
• Certificate details: issuer, expiry, key type, signature algorithm
• Protocol support: TLS 1.3/1.2 enabled, TLS 1.0/1.1/SSL 3.0 disabled
• Security features: Forward Secrecy, HSTS, OCSP Stapling status

What is a CPS? Certificate Practice Statement Explained

Finally understand the document that governs how your CA operates—and what happens when they don't follow it

After Entrust's 2024 distrust, more people are asking "what did they actually violate?" The answer is their CPS—and the Baseline Requirements it implements. This guide demystifies Certificate Practice Statements: what they are, how RFC 3647 structures them, which sections you should actually read (hint: Section 4 and 9.6), and why CAs that ignore their CPS end up in browser distrust announcements.

• CPS vs Certificate Policy: The law vs how you comply
• RFC 3647 framework with 9-section breakdown
• Key sections: Revocation timelines, subscriber obligations, liability caps
• Real-world consequences: DigiNotar, Symantec, Entrust

F5 Certificate Checklist + PKI Compliance Assessment

Two new checklists to prevent certificate mistakes and assess your PKI maturity

Installing certificates on F5 BIG-IP? The #1 mistake is forgetting the chain certificate—desktop browsers work fine but mobile devices fail silently. Our new F5 Certificate Checklist walks you through every step from file verification to post-installation cleanup, with the common mistakes table we wish we had years ago. Plus, the PKI Compliance Checklist helps you assess your organization's certificate management maturity with 87 items covering inventory, key security, automation readiness, and the upcoming 47-day certificate lifetime deadline.

• F5 BIG-IP SSL Certificate Checklist with 8 sections and troubleshooting table
• PKI Compliance Checklist with 11 sections and 87 assessment items
• Both include notes on CCADB, crt.sh, and upcoming validity deadlines
• Interactive checkboxes save progress to your browser

F5 BIG-IP SSL Series Begins

Finally make sense of F5 SSL profiles and load balancer certificate configuration

If you've ever stared at an F5 BIG-IP wondering why "Client SSL" is where your server certificate goes, you're not alone. We're launching a comprehensive 7-guide F5 series: SSL Profiles explained, Client SSL vs Server SSL decoded, certificate installation, chain configuration, troubleshooting, SSL Labs A+ optimization, and SNI configuration for hosting multiple certificates on a single IP.

• SSL Profiles, Client SSL vs Server SSL, and Certificate Installation
• Chain Configuration & Troubleshooting Runbook with debug commands
• SSL Labs A+ Grade: Cipher config, HSTS, and fixing common grade issues
• SNI Configuration: Multiple SSL certificates on one IP address

PKI Disasters Hall of Fame: All 4 Case Studies Live

The complete collection of CA failures that shaped internet security

The PKI Disasters Hall of Fame is now complete with four in-depth case studies spanning 13 years of certificate authority failures. From DigiNotar's catastrophic 2011 breach that may have cost lives in Iran, to WoSign's brazen backdating scheme, Symantec's "too big to fail" moment that proved no CA is untouchable, and Entrust's 2024 compliance saga—each story shows how quickly trust can evaporate. Whether you're managing certificates for a startup or an enterprise, these lessons will help you avoid becoming the next cautionary tale.

• DigiNotar 2011: The breach that killed a CA in 3 days
• WoSign/StartCom 2016: Backdating, secret acquisitions, and lies
• Symantec 2017: 30% of the internet's certs, sold in a fire sale
• Entrust 2024: When reputation couldn't save you

PKI News Aggregator

Stay on top of certificate industry changes without hunting through blogs

Keeping up with PKI news is exhausting—browser trust changes, CA incidents, new validation requirements, shorter certificate lifetimes. Miss an announcement and your certificates might stop working. The new PKI News page aggregates content from 8 authoritative sources including Google Security Blog, Let's Encrypt, DigiCert, and Cloudflare. We filter for PKI-relevant articles and highlight priority items like distrust announcements and security incidents, so you see what matters most.

• Curated from 8 industry sources including browser vendors and major CAs
• Priority highlighting for distrust, revocation, and security incidents
• Category filters: Browser Updates, CA News, Vendors, Research
• Automatic keyword filtering for PKI-relevant content only

Checklists & Runbooks Library

Copy-paste ready procedures for when certificates break

We've all been there—it's 2am, a certificate expired, and you're scrambling through old notes trying to remember the right sequence of commands. The new Checklists & Runbooks Library gives you structured, tested procedures you can follow step-by-step. Check off items as you go, copy commands directly to your terminal, and get back to bed faster. We're launching with 5 Priority 1 runbooks covering the scenarios you're most likely to hit: certificate renewal, emergency replacement, chain issues, key compromise, and CA migration.

• Interactive checklists with progress tracking (saves to browser)
• Copy-to-clipboard buttons on all commands
• Emergency P1 runbooks for when things break at 2am
• Print-friendly styling for offline reference

PKI Compliance Hub: Major Update

Find certificates faster, understand the Entrust situation, and troubleshoot chain problems

The Compliance Hub just got a lot more useful. Ever spent 20 minutes hunting for the correct intermediate certificate? That ends now. The new Chain Reference tab includes verified certificate data for 5 major CAs with SHA-256 fingerprints, direct PEM downloads, and crt.sh links. Plus, if you're still confused about what happened with Entrust, the CA Changes tab gives you the complete 8-event timeline from Google's announcement through Sectigo's acquisition. All data verified against official CA documentation.

• Chain Reference with roots & intermediates for Sectigo, DigiCert, Let's Encrypt, GlobalSign, and GoDaddy
• Complete Entrust-Sectigo acquisition timeline with customer guidance
• SHA-256 fingerprints with copy buttons and direct download links
• Let's Encrypt upcoming hierarchy (YE1/YE2/YE3, YR1/YR2/YR3) tracked for mid-2026

Entrust Distrust Timeline Added

Track when browsers stop trusting Entrust certificates

With major browsers announcing distrust of Entrust certificates, we've added a dedicated tracking row to our Compliance Hub's Root Store Comparison table. You can now see at a glance when Chrome, Mozilla, Apple, and Microsoft will stop trusting Entrust-issued certificates. If you're still using Entrust certs, this gives you a clear deadline to plan your migration.

• Browser-by-browser distrust dates in one view
• Integrated with Root Store Comparison table
• Clear visibility into migration timelines

CDN SSL Troubleshooting Series

Debug HTTPS issues across CloudFront, Fastly, Cloudflare, and more

CDN certificates are their own special kind of challenge. Origin certificates, edge certificates, SNI requirements—the list goes on. We've created a dedicated series covering the major CDN providers, with guides tailored to each platform's quirks. Next time you see ERR_SSL_VERSION_OR_CIPHER_MISMATCH from your CDN, you'll know exactly where to look.

• Provider-specific guides for major CDNs
• Common error messages decoded with solutions
• Origin vs. edge certificate configuration explained

12 PKI Mistakes (And How to Avoid Them)

Stop making the same mistakes everyone else does

We surveyed dozens of PKI deployments and found the same mistakes appearing over and over. This 4-part series covers the planning blunders, deployment disasters, operational oversights, and emergency fumbles that catch even experienced teams. Each mistake comes with concrete steps to avoid or fix it. Consider this your PKI deployment checklist.

• Real examples from production environments
• Organized by deployment phase for easy reference
• Prevention strategies you can implement today

ADCS Deep Dive Series

Finally understand Windows certificate infrastructure inside and out

Active Directory Certificate Services can feel like a black box—until now. Our new ADCS Deep Dive series walks you through every layer, from templates and auto-enrollment to troubleshooting the dreaded "trust chain could not be verified" errors. If you're managing Windows PKI, this series will save you hours of frustration.

• Complete coverage from installation to advanced troubleshooting
• Real-world scenarios from enterprise deployments
• Command examples you can copy and run

AI-Powered PKI Troubleshooter

Get instant, expert-level help diagnosing certificate issues

Stuck on a certificate error at 2 AM? We've added an AI-powered troubleshooter that understands the nuances of PKI. Tell it what you're working with (Venafi? F5? Java?), describe your error, and get step-by-step troubleshooting guidance. It's like having a PKI expert on call, without the consultant fees. We've trained it on real-world scenarios so it gives you actionable commands, not generic advice.

• Covers 18+ common products and platforms
• Returns verification commands you can run immediately
• Includes curated scenarios for common setups

We Hit 50 Interactive Demos!

More ways than ever to visualize how PKI actually works

When we started FixMyCert, we had one goal: make PKI understandable through visualization. This month, we hit a milestone—50 interactive demos covering everything from basic encryption to enterprise cert-manager deployments. Whether you're just learning what a certificate is or you're debugging mTLS in Kubernetes, there's a demo for you.

• Demos across 9 categories from fundamentals to enterprise
• Step-by-step animations you can pause and replay
• New cipher suite and CDN SSL demos added

PKI Compliance Hub

Track certificate validity deadlines and upcoming requirements

Certificate validity periods are shrinking. Apple, Google, and Mozilla keep proposing shorter lifespans. Our new Compliance Hub tracks all the deadlines you need to know about—from the 90-day proposals to the algorithm deprecation timelines. It's your single source of truth for "what's changing and when."

• Live timeline of validity period proposals
• Algorithm deprecation schedules
• CA/Browser Forum requirement summaries