Back to Guides
19 Guides

Certificates

X.509 certificates, file formats, and lifecycle management. From anatomy to automation with ACME and Let's Encrypt.

3 new recently
Certificates - Guide Series
Certificate Anatomy
Certificates

Certificate Anatomy

Explore every field in an X.509 certificate. Subject, issuer, extensions, and more.

7 minInteractive
Certificate Lifecycle
Certificates

Certificate Lifecycle

From CSR to expiration: the complete lifecycle of SSL/TLS certificates.

8 minInteractive
Certificate File Formats
Certificates

Certificate File Formats

PEM, DER, PFX, JKS - understand certificate file formats and how to convert between them.

6 minInteractive
CSR Builder
Certificates

CSR Builder

Generate Certificate Signing Requests interactively. Understand each field and extension.

5 minInteractive
DV vs OV vs EV Certificates
Certificates

DV vs OV vs EV Certificates

Domain, Organization, and Extended Validation certificates compared. Which do you need?

5 minInteractive
ACME Protocol
Certificates

ACME Protocol

How Let's Encrypt and ACME automate certificate issuance. HTTP-01 and DNS-01 challenges explained.

7 minInteractive
Root Stores
Certificates

Root Stores

What are root stores? How browsers and operating systems decide which CAs to trust.

6 minInteractive
CertificatesNEW

DigiCert Global Root G2: Verify Your Certificate Chain

Baltimore CyberTrust Root expired in May 2025 and Microsoft disables it on August 27, 2026. Here's how to confirm your chain moved to DigiCert Global Root G2.

8 min
PKCS#12 / PFX Files
Certificates

PKCS#12 / PFX Files

Understanding PKCS#12 format. Import, export, and manage PFX files with certificates and keys.

5 minInteractive
Self-Signed Certificates
Certificates

Self-Signed Certificates

When to use self-signed certificates. Create them properly for development and internal use.

5 minInteractive
What is a CPS?
Certificates

What is a CPS?

Certificate Practice Statements explained. What every PKI practitioner should know about their CA's operating procedures.

12 min
Domain Validation Methods Explained
Certificates

Domain Validation Methods Explained

How CAs verify domain ownership before issuing certificates. All 10 approved DCV methods from CA/Browser Forum BRs.

15 min
Extended Key Usage (EKU) Explained
Certificates

Extended Key Usage (EKU) Explained

What EKU is, why it matters, and how to check yours. Covers common EKUs, OID system, and the ClientAuth sunset.

10 min
Certificate Revocation Requirements
Certificates

Certificate Revocation Requirements

Learn the CA/Browser Forum's certificate revocation requirements - 24-hour and 5-day rules, what triggers mandatory revocation, and what happens when CAs don't comply.

14 min
Certificate Subscriber Obligations
Certificates

Certificate Subscriber Obligations

What you actually agreed to when you clicked 'I Accept' - private key protection, accuracy warranties, and what happens when you violate your subscriber agreement.

11 min
CSR Rejection Reasons
Certificates

CSR Rejection Reasons

CSR rejected by your CA? Learn the common reasons certificate signing requests fail - wrong key size, weak keys, invalid domains, bad formatting - and how to fix each one.

11 min
CAA Account Pinning (RFC 8657)
CertificatesNEW

CAA Account Pinning (RFC 8657)

Pin certificate issuance to your ACME account and validation method using RFC 8657 accounturi and validationmethods parameters. Mandatory March 15, 2027 under SC-098v2.

8 min
Client Authentication EKU Sunset
Certificates

Client Authentication EKU Sunset

Chrome and major CAs are removing Client Authentication EKU from public TLS certificates by March 2027. Learn who's affected, key deadlines, and migration options.

15 min
How to Find Client Authentication Certificates
CertificatesNEW

How to Find Client Authentication Certificates

Public CAs are removing the clientAuth EKU by March 2027. Here is how to find every client authentication certificate in your environment before renewals break.

10 min