Chapter 16
Taking it back: CRLs, OCSP and stapling
Revocation lets a CA cancel a certificate before it expires, but many clients check late, softly or not at all, so short lifetimes now do much of the work.
Topic
Revocation and transparency
When a private key leaks or a certificate is issued by mistake, the CA revokes it. Browsers check revocation in different ways, and much of that checking is soft-fail, which is one reason lifetimes are getting shorter.
Certificate Transparency makes publicly trusted TLS certificates visible in public logs, so you can spot certificates for your domains that you never asked for. This hub also covers the incidents that shaped today's rules.
Understand it: handbook chapters
Plain words first, then the real mechanism, what it looks like at work and why it matters.
Chapter 17
Certificate Transparency
Certificate Transparency records every publicly trusted TLS certificate in public, append-only logs, so anyone can spot a certificate for their name that they never asked for.
Chapter 18
Famous failures and what changed
Real PKI failures, from a hacked CA to expired certificates, follow one pattern: a weak point breaks trust, someone notices, and the rules or practices change.
Appendix
Timeline: how PKI got here
From the first public-key papers in the 1970s to ever-shorter certificate lifetimes and post-quantum key exchange: the milestones and incidents that shaped how certificates work today.
Do it: how-to guides
Step-by-step, with real commands and a way to check it worked.
How to monitor Certificate Transparency for your domains
You will have a scheduled check that lists every new publicly trusted certificate for your domains and flags any certificate issued by a CA you did not allow.
How to set CAA records for your domain
You will have DNS CAA records that let only the CAs you really use issue certificates for your names, with separate wildcard rules and an address for violation reports.
Fix it: error pages
The exact messages tools and browsers print, with likely causes and safe fixes.
Check yours: browser tools
They run in your browser. Nothing you paste is sent anywhere.
Tool
Certificate decoder
Paste a PEM certificate and read every field in plain words.
Tool
Chain checker
Paste a chain and see which link is missing, expired or out of order.
The big picture: crash course
Short lessons of about nine minutes each, with check questions.
Look it up: glossary terms
Every term in plain words, linked to its full entry.