CAA Records: The Certificate Restriction Nobody Sets
Every public CA has been required by the CA/Browser Forum Baseline Requirements to honor CAA records since 2017. It's free, it's one line of DNS, and after nine years barely 15% of sites use it.
Blog
Protocols, security incidents, and how the internet actually works. 147 posts.
HTTPS Everywhere Won. That Was the Easy Part.
In September 2026, Chrome started warning on plain HTTP by default. A fifteen-year campaign finished — and it turns out we solved the tractable problem, not the hard one.
The SSL Labs A+ Grade Is Too Easy to Get
An SSL Labs A+ certifies your TLS channel is configured well. People wave it around as proof they're secure. Under the current rules the gap between A- and A+ can be a single HTTP header — and a phishing kit clears it too.
Free SSL Certificates Made Phishing Easier
When HTTPS cost money, phishing sites mostly ran on plain HTTP. Free certificates didn't break TLS — they dissolved the one accidental signal users had been leaning on.
Your TLS Certificates Already Got Shorter
Everyone panicked about the 47-day certificate landing in 2029. Nobody noticed the first cut already happened: 200 days, mandatory since March 2026. The real story isn't validity — it's the revalidation clock dropping to 10 days.
Wildcard Certificates Are a Security Antipattern
One private key on every server, covering every subdomain you'll ever name. Wildcard certificates trade a small convenience for a blast radius you can't see — and the current standard spells out the risk.
Why Your Browser Trusts 150 Certificate Authorities
Any one of ~150 certificate authorities can mint a valid cert for your domain. Your security is the weakest of all of them. Here's why it mostly works anyway.
OCSP Stapling vs CRL: Why OCSP Lost the Revocation Fight
When a certificate is compromised, it needs to be revoked. CRLs and OCSP both failed browsers in different ways, and in 2025 the industry quietly picked the one everyone had written off.
Post-Quantum Cryptography: What Needs to Change in TLS
Quantum computers will break RSA and elliptic curve crypto. The transition has already started — not because quantum computers are here, but because 'harvest now, decrypt later' is a real threat.
SNI: The Field That Leaks Your Destination
HTTPS encrypts everything — except which website you're visiting. The Server Name Indication field travels in plaintext before encryption starts.
TLS 1.0/1.1 in 2026: Who's Still Serving?
TLS 1.0 and 1.1 are formally deprecated and rejected by every browser. And yet servers still offer them. How many, and why?
Certificate Transparency: Why Every Cert Is Public
Every TLS certificate issued by a public CA is logged in a publicly searchable, append-only log. This happened because of DigiNotar. Here's how CT works and why it matters.