TLS certificates

Certificate types

DV — domain validation (Let's Encrypt, free, 90 days). OV — + organization. EV — extended validation (costly, rarely justified). Wildcard — *.domain for subdomains.

Lifecycle

Since 2025 the max cert lifetime is 398 days, trending to 90 (Let's Encrypt already). Auto-renewal is mandatory: certbot, acme.sh, cert-manager in k8s.

Trust chain

Leaf → intermediate → root CA. Typical error: 'certificate chain incomplete' — the server sends only the leaf. Add fullchain.pem. Check: openssl s_client -connect host:443 -servername host.

Protocol versions

TLS 1.0/1.1 — banned (PCI DSS, browsers). TLS 1.2 — today's minimum. TLS 1.3 — faster (1-RTT), safer, no legacy ciphers. Disable SSLv3, RC4, DES, 3DES.

mTLS

Mutual authentication: the client also presents a certificate. Used for service-to-service (Istio/Linkerd meshes), API partners, VPNs.

Monitoring

Alert 14–30 days before expiry: cron with openssl x509 -enddate, or monitors (UptimeRobot, Prometheus blackbox_exporter). An expired cert = an outage.

About TLS Certificates — types, lifetimes, monitoring

TLS Certificates — types, lifetimes, monitoring — DV/OV/EV, wildcard, trust chain, TLS 1.2/1.3, mTLS and expiry alerts — a certificate guide.. IT Tools: TLS, API docs, glossary. Use our tools without registration or installing software. All calculations happen in your browser — your data is never sent to a server.