SSL Guide

Every certificate error tells a different story. These guides explain the "why" and the "how to fix" behind the situations SSLx diagnoses — and each page ends with a live test of your own site.

What is an incomplete certificate chain and how do you fix it?

Your certificate is valid, yet some browsers and tools call your site untrusted? The usual cause is a missing intermediate certificate. Symptoms, diagnosis and per-server fixes.

Self-signed certificates: legitimate uses, and why browsers reject them

What a self-signed certificate is, why browsers warn about it, when it is legitimate on internal networks and why it should never face the public internet — with diagnosis steps.

Your SSL certificate expired — what now?

What visitors see when a certificate expires, how to check remaining days, the emergency fix, and how automation plus monitoring prevents it from ever happening again.

Hostname mismatch: the certificate exists, but not for this name

Seeing NET::ERR_CERT_COMMON_NAME_INVALID in Chrome or "hostname mismatch" in curl? How SAN coverage works, the www vs bare-domain trap, and the fix.

Wildcard certificates: what *.example.com actually covers

Bought a wildcard but some addresses are still untrusted? *.example.com covers neither the bare domain nor second-level subdomains. The one-level rule, examples and fixes.

The certificate chain: how a browser decides to trust a site

How SSL certificate chains work: the roles of server, intermediate and root certificates, how the trust path is built, and the four places where chains break.

CSR (Certificate Signing Request): the first step of every certificate

What a CSR contains, how to generate one with OpenSSL, and how to inspect it before submitting. The private-key relationship and the most common mistakes.

HSTS: telling browsers "only ever reach this site over HTTPS"

What HTTP Strict Transport Security does, the attack it prevents, and how to enable it. max-age, includeSubDomains and preload options, with the caveats that matter.