Posts tagged with SSL/TLS on the WebPixie Blog.https://webpixie.io/blog/en-gbhttps://webpixie.io/blog/post/bgp-hijack-valid-tls-certificate-virtualizorhttps://webpixie.io/blog/post/bgp-hijack-valid-tls-certificate-virtualizorThe attacker's certificate for Virtualizor's domains was real, correctly chained, and issued by Let's Encrypt. That's the actual story: certificate validity checks the cert, not the network path serving it.Mon, 14 Sep 2026 08:33:00 GMTSSL/TLSMonitoringMatt Scotthttps://webpixie.io/blog/post/chrome-154-http-warning-subdomain-audithttps://webpixie.io/blog/post/chrome-154-http-warning-subdomain-auditChrome 154 turns on HTTPS-by-default warnings for everyone in October 2026. Finding your subdomains is the easy part. Knowing which of them actually need fixing before then is the part nobody's writing about.Sat, 12 Sep 2026 20:47:00 GMTSSL/TLSMonitoringMatt Scotthttps://webpixie.io/blog/post/ocsp-stapling-2026https://webpixie.io/blog/post/ocsp-stapling-2026Let's Encrypt shut down OCSP entirely in August 2025. Chrome and Firefox both moved revocation checking off the live connection years ago. Most OCSP stapling tutorials still teach it as the default, without saying any of that.Tue, 08 Sep 2026 10:15:00 GMTSSL/TLSMonitoringMatt Scotthttps://webpixie.io/blog/post/lets-encrypt-rate-limits-2026https://webpixie.io/blog/post/lets-encrypt-rate-limits-2026Let's Encrypt's shift to 45-day certificates will double daily renewal requests. Here is which rate limit you actually hit, why, how long until it resets, and the one mechanism most automated setups already have that sidesteps the problem entirely.Sat, 05 Sep 2026 09:36:00 GMTSSL/TLSMonitoringMatt Scotthttps://webpixie.io/blog/post/ssl-monitor-certificate-chain-checkhttps://webpixie.io/blog/post/ssl-monitor-certificate-chain-checkMost SSL monitoring dashboards show a green check for two things: the TLS handshake succeeded and the certificate has not expired. Neither one confirms the chain is complete, and an incomplete chain fails silently for exactly the clients your monitor never tests.Fri, 21 Aug 2026 09:36:00 GMTSSL/TLSMonitoringMatt Scotthttps://webpixie.io/blog/post/acme-renewal-informationhttps://webpixie.io/blog/post/acme-renewal-informationACME Renewal Information (RFC 9773) lets a CA tell your client to renew earlier than the raw expiry date suggests. Every guide treats it as an ACME-client feature. None treats it as a second signal an external monitor could watch.Mon, 20 Jul 2026 20:50:00 GMTSSL/TLSMatt Scotthttps://webpixie.io/blog/post/certificate-inventory-ct-logshttps://webpixie.io/blog/post/certificate-inventory-ct-logsBuilding a certificate inventory from scratch is unnecessary work. Certificate Transparency logs already record every certificate issued for your domain, in public, for free. Here is how to read that record yourself.Sun, 19 Jul 2026 17:02:00 GMTSSL/TLSMonitoringMatt Scotthttps://webpixie.io/blog/post/lets-encrypt-expiration-emailshttps://webpixie.io/blog/post/lets-encrypt-expiration-emailsLet's Encrypt ended its certificate expiration emails in June 2025. Here is why its own recommended fix does not solve the real problem, and what actually catches a renewal that fails silently.Fri, 17 Jul 2026 17:02:00 GMTSSL/TLSMonitoringMatt Scotthttps://webpixie.io/blog/post/check-ssl-certificate-expirationhttps://webpixie.io/blog/post/check-ssl-certificate-expirationChecking an SSL certificate's expiration takes ten seconds with a browser or openssl. The real problem: certificate lifespans have already dropped to 200 days and reach 47 by 2029, so a once-a-year manual check no longer protects you. Here is how to check, and how to automate it.Sat, 13 Jun 2026 13:18:00 GMTSSL/TLSMonitoringMatt Scott