November 12, 2026 · 5 min read – What Is an HSM? Hardware Security Modules and TPMs ExplainedWhat Is an HSM? Hardware Security Modules and TPMs Explained
What Is an HSM? Hardware Security Modules and TPMs Explained
A certificate is only as secure as the private key behind it. If that key sits in a file on a server, anyone who takes over the server can copy it, and nobody will notice the copy. That is why valuable keys belong in hardware they cannot leave: in a hardware security ... Continue Reading →
How to Run a Private Certificate Authority
For public websites, a certificate authority such as Let’s Encrypt is the right choice. But many certificates are never checked by strangers’ browsers at all: servers on a company network, devices, VPN gateways, client certificates or services in Kubernetes. ... Continue Reading →
What Is Mutual TLS (mTLS)? Client Certificates Explained
On an ordinary HTTPS connection only the server proves who it is: it presents its certificate and the browser checks it. Who the visitor is gets settled afterwards by the website, with a password or a passkey. With mutual TLS (mTLS), the client presents a certificate ... Continue Reading →
What Are CAA Records, DNSSEC and DANE?
Every certificate authority in the root stores is, in principle, allowed to issue for any domain. As a domain owner you can restrict that, and you do it where your domain is already managed: in DNS. A CAA record states which CAs may issue certificates for your ... Continue Reading →
What Are SAN and Wildcard Certificates?
A certificate is not valid for “a website” but for specific names. Which names they are is set out in the Subject Alternative Name (SAN) extension. It can list several domains, or a wildcard that covers many subdomains in one go. This guide explains ... Continue Reading →
Why Certificate Lifetimes Are Shrinking to 47 Days
A little over ten years ago you could buy a website certificate valid for up to five years and forget about it. Today public certificates last at most 200 days, from March 2027 only 100 days, and from March 2029 just 47 days. The CA/Browser Forum agreed this in ... Continue Reading →
What Is Certificate Transparency? Logs, SCTs and Monitoring
Every certificate authority your browser trusts can, technically, issue a certificate for any domain, including yours. How would you know if one did so wrongly? The answer is Certificate Transparency (CT): every publicly trusted website certificate must be recorded ... Continue Reading →
How Certificate Revocation Works: CRL, OCSP and Stapling
A certificate is valid until its expiry date. But what if something goes wrong before then, for example because the private key has been stolen? Then the certificate authority must revoke the certificate, and browsers need to find out. That is harder than it sounds. ... Continue Reading →
What Is a Root Store? How Browsers Decide Which CAs to Trust
Every certificate chain ends at a root certificate that your device trusts from the outset. But who decides which root certificates those are? The answer lies in the root stores of operating systems and browsers, and the root programmes that run them. Between them, ... Continue Reading →
Recent Comments