TLS CERTIFICATES
Certificates used to expire because somebody forgot. Now they expire because a job stopped running, and the job is on a server nobody currently employed configured.
Automation removed most certificate failures and made the remaining ones considerably harder to see, including one that works perfectly in your own browser and fails for everyone else.
This guide covers how TLS actually works, what shortened lifetimes changed, and how to find where your renewal runs before it stops.
In this guide you will learn:
Identity, trust chains, and the root store.
What happens between request and page, step by step.
Ninety days, ACME, and the new failure mode.
Why it works for you and breaks for a visitor.
The four causes, and what each one needs.
CAA, and who can currently issue for your domain.
From a machine that has never visited your site.
Every certificate ever issued is public. Use it.
Chapter 1
Identity, trust chains, and the root store.
This chapter is not written yet. Drop the prose into
guide-bodies/<body>.html and rebuild.
Chapter 2
What happens between request and page, step by step.
This chapter is not written yet. Drop the prose into
guide-bodies/<body>.html and rebuild.
Chapter 3
Ninety days, ACME, and the new failure mode.
This chapter is not written yet. Drop the prose into
guide-bodies/<body>.html and rebuild.
Chapter 4
Why it works for you and breaks for a visitor.
This chapter is not written yet. Drop the prose into
guide-bodies/<body>.html and rebuild.
Chapter 5
The four causes, and what each one needs.
This chapter is not written yet. Drop the prose into
guide-bodies/<body>.html and rebuild.
Chapter 6
CAA, and who can currently issue for your domain.
This chapter is not written yet. Drop the prose into
guide-bodies/<body>.html and rebuild.
Chapter 7
From a machine that has never visited your site.
This chapter is not written yet. Drop the prose into
guide-bodies/<body>.html and rebuild.
Chapter 8
Every certificate ever issued is public. Use it.
This chapter is not written yet. Drop the prose into
guide-bodies/<body>.html and rebuild.
Check yours
Everything in this guide, checked on your domain in about ten seconds. Free, no account, every finding shown in full.