TLS certificates

Certificate types

DV — domain validation (Let's Encrypt, free, 90 days). OV — + organization. EV — extended validation (costly, rarely justified). Wildcard — *.domain for subdomains.

Lifecycle

Since 2025 the max cert lifetime is 398 days, trending to 90 (Let's Encrypt already). Auto-renewal is mandatory: certbot, acme.sh, cert-manager in k8s.

Trust chain

Leaf → intermediate → root CA. Typical error: 'certificate chain incomplete' — the server sends only the leaf. Add fullchain.pem. Check: openssl s_client -connect host:443 -servername host.

Protocol versions

TLS 1.0/1.1 — banned (PCI DSS, browsers). TLS 1.2 — today's minimum. TLS 1.3 — faster (1-RTT), safer, no legacy ciphers. Disable SSLv3, RC4, DES, 3DES.

mTLS

Mutual authentication: the client also presents a certificate. Used for service-to-service (Istio/Linkerd meshes), API partners, VPNs.

Monitoring

Alert 14–30 days before expiry: cron with openssl x509 -enddate, or monitors (UptimeRobot, Prometheus blackbox_exporter). An expired cert = an outage.

Over TLS-certificaten — typen, looptijden, monitoring

TLS-certificaten — typen, looptijden, monitoring — DV/OV/EV, wildcard, vertrouwensketen, TLS 1.2/1.3, mTLS en verloop-alerts — een certificatengids.. IT-tools: TLS, API-docs, glossarium. Gebruik onze tools zonder registratie of software-installatie. Alle berekeningen gebeuren in uw browser — uw gegevens worden nooit naar een server gestuurd.