# Learn SSL/TLS: how HTTPS, certificates and the Web PKI work

> In-depth explainers on TLS 1.3, certificate chains, CT, revocation, ACME, CAA, HSTS, mTLS, post-quantum TLS and the move to 47-day certificates.

Source: https://ssl.sh/learn/
Last updated: 2026-11-10

These explainers answer the "why" behind HTTPS: what TLS protects, how a handshake proves identity, how browsers decide to trust a certificate, and how certificates are issued, revoked and renewed. Every article starts with a direct answer, then goes as deep as the topic needs, with Markdown tables, ASCII diagrams and real command output instead of images.

## How the articles are organized

- **Basics** explains the protocol from the ground up: [how TLS works](https://ssl.sh/learn/how-tls-works/), [the TLS 1.3 handshake message by message](https://ssl.sh/learn/tls-handshake/) and [cipher suites](https://ssl.sh/learn/cipher-suites/).
- **Certificates** covers the Web PKI: [chains of trust](https://ssl.sh/learn/certificate-chains/), [DV, OV and EV validation](https://ssl.sh/learn/dv-ov-ev/), [file formats](https://ssl.sh/learn/certificate-formats/), [Certificate Transparency](https://ssl.sh/learn/certificate-transparency/) and [revocation with OCSP and CRLs](https://ssl.sh/learn/ocsp-and-crl/).
- **Protocol** looks at specific features: [TLS 1.3](https://ssl.sh/learn/tls-1-3/), [HSTS](https://ssl.sh/learn/hsts/) and [mutual TLS](https://ssl.sh/learn/mtls/).
- **Operations** is about running certificates in production: [the ACME protocol](https://ssl.sh/learn/acme-protocol/), [automated renewal](https://ssl.sh/learn/automate-certificate-renewal/) and [CAA records](https://ssl.sh/learn/caa-records/).
- **What's next** tracks the changes already scheduled: [47-day certificates](https://ssl.sh/learn/47-day-certificates/) and [post-quantum TLS](https://ssl.sh/learn/post-quantum-tls/).

## Sources and accuracy

Every factual claim is tied to a primary source listed at the bottom of each page: IETF RFCs, the CA/Browser Forum Baseline Requirements and ballots, root program policies from Chrome, Mozilla and Apple, Let's Encrypt announcements and the OpenSSL manual. When something is still changing, the article says "as of November 2026" rather than guessing a date. For the full lifetime schedule see the [certificate validity timeline](https://ssl.sh/timeline/certificate-validity/).