Guides
From choosing a certificate type to installing it and keeping it alive.
Choosing the right certificate
DV, OV or EV; single name, wildcard or multi-SAN. The two decisions that shape everything after.
Issuing automatically with ACME
Free 90-day certificates from Let's Encrypt that renew themselves. The default answer.
Issuing manually from a commercial CA
Key, CSR, validation and collection by hand — for OV/EV or an offline key.
Where to buy one
The four cases a paid certificate actually solves, and a link to each type. Carries affiliate links, and says so.
Installing on your web server
nginx, Apache, Caddy, HAProxy, IIS, Tomcat and Node.js, each with its own gotcha.
Verifying and renewing
Check what the server really serves, then make sure it never expires on you.
Fixing common SSL errors
ERR_CERT_AUTHORITY_INVALID, name mismatches, curl 60, PKIX failures — cause and fix for each.
OpenSSL command reference
Thirty commands worth keeping within reach, grouped by what you are trying to do.