November 10, 2026 · 5 min read – Why Certificate Lifetimes Are Shrinking to 47 DaysWhy Certificate Lifetimes Are Shrinking to 47 Days
Why Certificate Lifetimes Are Shrinking to 47 Days
A little over ten years ago you could buy a website certificate valid for up to five years and forget about it. Today public certificates last at most 200 days, from March 2027 only 100 days, and from March 2029 just 47 days. The CA/Browser Forum agreed this in ... Continue Reading →
What Is Certificate Transparency? Logs, SCTs and Monitoring
Every certificate authority your browser trusts can, technically, issue a certificate for any domain, including yours. How would you know if one did so wrongly? The answer is Certificate Transparency (CT): every publicly trusted website certificate must be recorded ... Continue Reading →
How Certificate Revocation Works: CRL, OCSP and Stapling
A certificate is valid until its expiry date. But what if something goes wrong before then, for example because the private key has been stolen? Then the certificate authority must revoke the certificate, and browsers need to find out. That is harder than it sounds. ... Continue Reading →
What Is a Root Store? How Browsers Decide Which CAs to Trust
Every certificate chain ends at a root certificate that your device trusts from the outset. But who decides which root certificates those are? The answer lies in the root stores of operating systems and browsers, and the root programmes that run them. Between them, ... Continue Reading →
Certificate File Formats Explained: PEM, DER, PKCS#7 and PFX
Install a certificate and you soon meet a jumble of file extensions: .pem, .crt, .cer, .der, .key, .p7b, .pfx and .p12. One server wants two files, another wants a single file with a password, and sometimes a server rejects a file even though the certificate inside ... Continue Reading →
How to Create a Private Key and CSR With OpenSSL
Before a certificate authority can issue a certificate, it needs the public key it is going to vouch for. You hand it over in a certificate signing request, or CSR. The key pair and the CSR are created on your own machine, usually with the free OpenSSL toolkit. ... Continue Reading →
How Certificate Authorities Work: DV, OV and EV Explained
For a browser to trust a website’s certificate, the certificate must be signed by a certificate authority (CA). The CA vouches that whoever asked for the certificate really controls the domain and, for some certificate types, that a real organisation stands ... Continue Reading →
How the Certificate Chain of Trust Works
A certificate is only as trustworthy as the organisation that signed it. So how does your browser know it can trust that organisation? The answer is the chain of trust: from a website’s certificate, a series of signatures leads up to a root certificate that ... Continue Reading →
What Is an X.509 Certificate? What Is Inside a Certificate
Every time your browser shows a padlock next to a web address, it has first checked a certificate. That certificate is a small file the server sends while the connection is being set up, and it almost always follows the same standard: X.509. The standard defines ... Continue Reading →
Recent Comments