> Step-by-step PKI and TLS guides: inspect, create, convert, trust, install and automate certificates, with real commands, real output and safe fixes. Source: https://pkizerotohero.com/guides/ · Last reviewed: 2026-10-20 How-to guides # How-to guides Step-by-step guides for the jobs people actually do with certificates: check, create, convert, trust, install and automate. Real commands, real output, and never "turn off verification". 35 of 35 guides published in this early edition. [Fixing an error? Error pages](https://pkizerotohero.com/errors/)[Browser tools](https://pkizerotohero.com/tools/) Each guide takes one real task from start to finish: inspecting a certificate, creating a CSR, converting a PFX, trusting a private root, installing a certificate or automating renewal. We run the commands for real wherever we can and show their real output, and every guide ends with a check that proves it worked, the problems you are most likely to meet, and the handbook chapter that explains why it works. None of them asks you to switch certificate checking off or to paste a private key into a website. ## Inspect and check Read a certificate, check the chain a server sends, and prove a key matches. ### [How to inspect a certificate with OpenSSL](https://pkizerotohero.com/guides/inspect-certificate-openssl/) You will have read a certificate file or a server's certificate with OpenSSL and found its names, dates, issuer, key and fingerprint. - Linux - macOS - Windows - Java Level: Beginner ### [How to check the certificate chain a server sends](https://pkizerotohero.com/guides/check-remote-certificate-chain/) You will have listed every certificate a server sends, checked their order and links, and verified the chain with a strict client instead of a browser. - Linux - macOS - Windows - Java Level: Practitioner ### [How to check that a private key matches a certificate](https://pkizerotohero.com/guides/check-key-matches-certificate/) You will have proved, without exposing the key, that a private key, its CSR and a certificate share one public key, or found the file that does not belong. - Linux - macOS - Windows - Java Level: Practitioner ## Create keys and CSRs Make a key pair and a certificate signing request on any platform. ### [How to create a key and a CSR with OpenSSL (with SANs)](https://pkizerotohero.com/guides/create-csr-openssl/) You will have a new private key that never leaves your server, and a verified certificate signing request that lists every name your certificate needs. - Linux - macOS - Windows Level: Beginner ### [How to create a CSR on Windows (certreq and IIS)](https://pkizerotohero.com/guides/create-csr-windows/) You will have a CSR with all your names, whose private key stays inside the Windows key store, and know how to install the certificate when it returns. - Windows - IIS Level: Practitioner ### [How to create a CSR with Java keytool](https://pkizerotohero.com/guides/create-csr-java-keytool/) You will have a key pair in a PKCS #12 keystore, a CSR whose SAN list really reaches the CA, and the signed certificate chain installed under the same alias. - Java Level: Practitioner ## Convert file formats Move certificates and keys between PEM, DER, PFX and Java keystores. ### [How to convert PFX (PKCS #12) to PEM and back](https://pkizerotohero.com/guides/convert-pfx-pem/) You will have split a PFX into PEM files for the certificate, the chain and the key, or packed PEM files into a PFX that Windows and Java can import. - Linux - macOS - Windows - IIS Level: Practitioner ### [How to convert between DER and PEM](https://pkizerotohero.com/guides/convert-der-pem/) You will have identified whether a file is DER or PEM and converted certificates, keys, CSRs, CRLs and bundles between the two, with proof that nothing changed. - Linux - macOS - Windows - Java Level: Beginner ### [How to convert a Java keystore (JKS) to PKCS #12](https://pkizerotohero.com/guides/convert-jks-pkcs12/) You will have moved every key and trusted certificate from a JKS keystore into a standard PKCS #12 file that Java, OpenSSL and Windows can read, and updated your settings. - Java Level: Practitioner ## Trust a CA Make computers, languages and tools trust a private or corporate CA, safely. ### [How to work behind a TLS-inspecting corporate proxy, safely](https://pkizerotohero.com/guides/corporate-proxy-certificates/) You will have confirmed that your traffic is inspected, obtained your company's inspection root through a trusted channel, and made each tool trust it with verification still on. - Windows - macOS - Linux - Java Level: Practitioner ### [How to trust a private root CA on Windows](https://pkizerotohero.com/guides/add-root-ca-windows/) Your Windows computer, or a whole fleet, trusts your organisation's private root CA, and you know which apps still need their own setting. - Windows Level: Practitioner ### [How to trust a private root CA on macOS](https://pkizerotohero.com/guides/add-root-ca-macos/) Your Mac, or every managed Mac, trusts your organisation's private root CA in the System keychain, and you know which apps need their own setting. - macOS Level: Practitioner ### [How to trust a private root CA on Linux](https://pkizerotohero.com/guides/add-root-ca-linux/) Your Linux server, desktop or container image trusts your organisation's private root CA system-wide, and you know which programs keep their own list. - Linux - Docker Level: Practitioner ### [How to add a CA to a Java trust store (cacerts)](https://pkizerotohero.com/guides/add-root-ca-java/) Your Java program trusts your private root CA, either through the JDK's cacerts or through its own trust store, and you have proved it with a real connection. - Java - Linux - Windows - macOS Level: Practitioner ### [How to make Python, Node.js and npm trust a private CA](https://pkizerotohero.com/guides/trust-ca-python-node/) Python, pip, requests, Node.js and npm trust your private root CA, through the operating system's store or a bundle file, with verification still fully on. - Linux - macOS - Windows - Python Level: Practitioner ## Install on a server Put a certificate and its chain on nginx, Apache, IIS and Java servers. ### [How to build the full chain file your server needs](https://pkizerotohero.com/guides/build-fullchain/) You will have one PEM file with your certificate followed by its intermediates in the right order, verified offline and proven to work with a strict client. - Linux - nginx - Apache - Kubernetes Level: Practitioner ### [How to install a certificate in nginx](https://pkizerotohero.com/guides/install-certificate-nginx/) nginx serves your certificate and its full chain on port 443, with a key that matches, and you have proved it from the outside with OpenSSL and curl. - Linux - nginx Level: Practitioner ### [How to install a certificate in Apache httpd](https://pkizerotohero.com/guides/install-certificate-apache/) Apache httpd serves your certificate with its full chain from one SSLCertificateFile, with a matching key, and you have proved it from outside. - Linux - Apache Level: Practitioner ### [How to install a certificate in IIS](https://pkizerotohero.com/guides/install-certificate-iis/) IIS serves your certificate with its private key and intermediate on an HTTPS binding with SNI, and renewed certificates get rebound instead of silently expiring. - Windows - IIS Level: Practitioner ### [How to install a certificate in Tomcat and other Java servers](https://pkizerotohero.com/guides/install-certificate-tomcat/) Tomcat, or a Spring Boot or other Java server, serves your certificate with its full chain from PEM files or a PKCS #12 keystore, verified from outside. - Linux - Windows - Java - Tomcat Level: Practitioner ## Automate renewal Get and renew certificates without a human: certbot, cert-manager, win-acme. ### [How to get and renew Let's Encrypt certificates with certbot](https://pkizerotohero.com/guides/certbot-lets-encrypt/) certbot gets a Let's Encrypt certificate for your Linux server, installs it, renews it automatically on the CA's schedule, and reloads your web server each time. - Linux - nginx - Apache Level: Practitioner ### [How to automate certificates in Kubernetes with cert-manager](https://pkizerotohero.com/guides/kubernetes-cert-manager/) cert-manager issues Let's Encrypt certificates for your Kubernetes Ingresses or Certificate resources, stores them in Secrets and renews them before they expire. - Kubernetes - Linux Level: Practitioner ### [How to automate certificates on Windows with win-acme](https://pkizerotohero.com/guides/win-acme-windows/) win-acme gets Let's Encrypt certificates for your IIS sites, binds them, and renews them every day from a scheduled task that follows the CA's renewal advice. - Windows - IIS Level: Practitioner ### [How to get a wildcard certificate with DNS-01](https://pkizerotohero.com/guides/wildcard-dns-01/) You will have a publicly trusted certificate for \*.example.com and example.com, issued through the ACME DNS-01 challenge with a narrowly scoped DNS key, and renewing by itself. - Linux - Windows Level: Practitioner ## Operate and monitor Watch expiry and Certificate Transparency, and get ready for short lifetimes. ### [How to check when a certificate expires, and monitor it](https://pkizerotohero.com/guides/check-certificate-expiry/) You will have read expiry dates in files, live servers and certificate stores, and set up a check that warns before any certificate in a chain runs out. - Linux - macOS - Windows - Kubernetes Level: Practitioner ### [How to monitor Certificate Transparency for your domains](https://pkizerotohero.com/guides/monitor-certificate-transparency/) You will have a scheduled check that lists every new publicly trusted certificate for your domains and flags any certificate issued by a CA you did not allow. - Linux - macOS - Windows Level: Practitioner ### [How to prepare for short-lived certificates: a checklist](https://pkizerotohero.com/guides/prepare-47-day-certificates/) You will have a dated plan that moves every public TLS certificate to automated renewal, with an inventory, owners, ARI, independent monitoring and a budget, before lifetimes shrink. - Linux - Windows - Kubernetes Level: Practitioner ## Harden and secure TLS settings, CAA records and mutual TLS done properly. ### [How to set CAA records for your domain](https://pkizerotohero.com/guides/caa-records/) You will have DNS CAA records that let only the CAs you really use issue certificates for your names, with separate wildcard rules and an address for violation reports. - Linux - macOS - Windows Level: Practitioner ### [How to configure TLS securely (versions, ciphers, HSTS)](https://pkizerotohero.com/guides/tls-configuration/) You will have a web server that offers only TLS 1.2 and 1.3 with forward-secret ciphers, staples OCSP only where it still applies, sends HSTS safely, and passes testing. - nginx - Apache - Linux - Windows Level: Practitioner ### [How to set up mutual TLS (nginx and curl)](https://pkizerotohero.com/guides/mutual-tls-setup/) You will have an nginx endpoint that accepts only clients holding a certificate from your own client CA, lets in only the clients you name, and is tested with curl. - nginx - Linux - Windows Level: Practitioner ## Labs and advanced Private CAs, code signing, SSH certificates and post-quantum TLS. ### [How to run a small private CA with step-ca (lab)](https://pkizerotohero.com/guides/private-ca-step-ca/) You will have a lab CA running smallstep's step-ca that issues and renews 24-hour certificates, speaks ACME, and refuses names outside your lab domain. - Linux - macOS Level: Practitioner ### [How to build a test CA with OpenSSL (lab only)](https://pkizerotohero.com/guides/openssl-test-ca/) You will have a two-tier test CA built with openssl ca: a root, a name-constrained issuing CA, server and client certificates, a revocation and working CRLs. - Linux - macOS - Windows Level: Practitioner ### [How to sign code with signtool and cosign](https://pkizerotohero.com/guides/code-signing-signtool-cosign/) You will sign and timestamp a Windows program with SignTool, sign a release file with Sigstore cosign, and verify both, including who signed and when. - Windows - Linux - macOS Level: Practitioner ### [How to use SSH certificates instead of known\_hosts](https://pkizerotohero.com/guides/ssh-certificates/) You will have OpenSSH host and user certificates signed by your own CAs, so clients trust servers without first-use prompts and servers trust short-lived user certificates. - Linux - macOS - Windows Level: Practitioner ### [How to test post-quantum hybrid TLS](https://pkizerotohero.com/guides/post-quantum-tls-test/) You will know whether your servers and network negotiate the X25519MLKEM768 hybrid key exchange, and how to read, force and troubleshoot it with OpenSSL 3.5. - Linux - macOS - Windows Level: Expert Last reviewed 20 October 2026