Learn SSL/TLS
Sixteen in-depth explainers on how TLS and the Web PKI work, each with a short answer up front, diagrams in plain text and links to the RFCs and policies behind it.
These explainers answer the "why" behind HTTPS: what TLS protects, how a handshake proves identity, how browsers decide to trust a certificate, and how certificates are issued, revoked and renewed. Every article starts with a direct answer, then goes as deep as the topic needs, with Markdown tables, ASCII diagrams and real command output instead of images.
How the articles are organized
- Basics explains the protocol from the ground up: how TLS works, the TLS 1.3 handshake message by message and cipher suites.
- Certificates covers the Web PKI: chains of trust, DV, OV and EV validation, file formats, Certificate Transparency and revocation with OCSP and CRLs.
- Protocol looks at specific features: TLS 1.3, HSTS and mutual TLS.
- Operations is about running certificates in production: the ACME protocol, automated renewal and CAA records.
- What's next tracks the changes already scheduled: 47-day certificates and post-quantum TLS.
Sources and accuracy
Every factual claim is tied to a primary source listed at the bottom of each page: IETF RFCs, the CA/Browser Forum Baseline Requirements and ballots, root program policies from Chrome, Mozilla and Apple, Let's Encrypt announcements and the OpenSSL manual. When something is still changing, the article says "as of November 2026" rather than guessing a date. For the full lifetime schedule see the certificate validity timeline.
Basics
How TLS works
How TLS protects HTTPS: key exchange, certificates, symmetric encryption, the record layer, and one request traced from TCP to HTTP/3.
TLS handshake
Every TLS 1.3 handshake message explained: ClientHello extensions, HelloRetryRequest, encrypted server flight, Finished, tickets and 0-RTT.
Cipher suites
How to read a TLS 1.2 cipher suite name, why TLS 1.3 has only five suites, which ones to disable, and nginx/Apache configs that follow Mozilla's guidance.
Certificates
Certificate chains
How clients build and verify a chain from your leaf certificate to a trusted root, why missing intermediates break, and what your server should send.
DV vs OV vs EV
DV, OV and EV certificates differ only in how much the CA checks about you, not in encryption. What each level validates and which one to choose.
Certificate formats
PEM, DER, PKCS#7, PKCS#12 and JKS explained: what each file can hold, how to identify an unknown file, and which format each server expects.
Certificate Transparency
How Certificate Transparency logs every public TLS certificate, what SCTs are, what Chrome, Safari and Firefox require, and how to monitor domains.
OCSP and CRL
How CRLs and OCSP report revoked certificates, why Let's Encrypt shut down OCSP in 2025, and how Chrome CRLSets and Firefox CRLite check revocation.
Protocol
TLS 1.3
TLS 1.3 explained: removed legacy crypto, 1-RTT and 0-RTT handshakes, encrypted certificates, downgrade protection, compatibility and how to turn it on.
HSTS
How HTTP Strict Transport Security works, what max-age, includeSubDomains and preload do, how to roll it out safely and why preloading is hard to undo.
Mutual TLS (mTLS)
How mTLS adds client certificate authentication to TLS 1.3, why it needs a private CA, and how Chrome and Let's Encrypt changes in 2026 affect it.
Operations
ACME protocol
ACME (RFC 8555) step by step: accounts, JWS requests, orders, http-01/dns-01/tls-alpn-01 challenges, ARI renewal windows and certificate profiles.
Automate renewal
Why manual renewal fails as lifetimes drop to 200, 100 and 47 days, and how to automate issuance, deployment, reloads and monitoring with ACME.
CAA records
How DNS CAA records limit which CAs may issue for your domain: issue, issuewild, iodef, tree climbing, and RFC 8657 accounturi and validationmethods.
What's next
47-day certificates
CA/Browser Forum Ballot SC-081v3 cuts certificate lifetimes from 398 to 47 days by 2029 and domain validation reuse to 10 days. Dates, reasons and a checklist.
Post-quantum TLS
Post-quantum TLS in 2026: the hybrid ML-KEM key exchange browsers already use, why post-quantum certificates are hard, and how Merkle Tree Certificates help.
FAQ
Where should I start if I am new to TLS?
Read How TLS works first, then The TLS handshake and Certificate chains. Those three cover most of what you need to debug a certificate error.
How current are these articles?
Each article shows the date it was last checked against its sources. Time-sensitive statements are written as of November 2026, and the certificate lifetime schedule follows CA/Browser Forum Ballot SC-081v3.
Where do I find commands without the explanations?
Use the OpenSSL cookbook for copy-paste commands with sample output, or the SSL checker to test a live site.