SSL/TLS Certificate Types
debt(d7/e3/b3/t5)
Closest to 'only careful code review or runtime testing' (d7). Tools like certbot, ssllabs, ssl-cert-check, and datadog can detect expiry and misconfigurations, but choosing the wrong certificate type (e.g. EV over DV, missing HSTS, wildcard scope misunderstanding) is not automatically flagged — it requires deliberate configuration review or a runtime failure (e.g. cert expiry causing outage, CURLOPT_SSL_VERIFYPEER disabled silently).
Closest to 'simple parameterised fix' (e3). The quick_fix points to migrating to Let's Encrypt with automated renewal — a pattern replacement that may touch server configs and deployment scripts within one component/service but is not cross-cutting. Fixing manual renewal or adding HSTS is similarly a small, localised change.
Closest to 'localised tax' (b3). The applies_to is web contexts only, and the choice of certificate type primarily affects a specific service's TLS configuration. While expiry monitoring and renewal automation must be maintained, the burden is confined to infrastructure/ops for that service and doesn't reshape the broader codebase.
Closest to 'notable trap (a documented gotcha most devs eventually learn)' (t5). The misconception field explicitly calls out that EV certificates are widely believed to provide better security when they do not — browsers no longer visually distinguish them, and the encryption is identical to DV. Additionally, wildcard cert scope (*.example.com not covering sub.sub.example.com) is a well-documented but commonly encountered gotcha.
Also Known As
TL;DR
Explanation
DV: CA verifies domain control via DNS or file challenge; issued in minutes; Let's Encrypt is the standard. OV: CA verifies the organisation is real; 1-3 days. EV: rigorous identity verification; browsers removed the green bar in 2019. Wildcard (*.example.com) covers all first-level subdomains. Certbot automates 90-day renewal via the ACME protocol.
Common Misconception
Why It Matters
Common Mistakes
- Manual certificate renewal — expires and causes downtime
- Wildcard cert scope — *.example.com does not cover sub.sub.example.com
- Private key not stored securely
- No HSTS header — allows downgrade attacks
Code Examples
# Manual certificate management — expires, causes downtime:
# Install cert manually every 12 months
# Cert expires: users see 'Your connection is not private'
# Fix: scramble to renew, 2-4 hours downtime# Let's Encrypt with automatic renewal:
sudo certbot --nginx -d example.com -d www.example.com
# Cron auto-renews 30 days before expiry
# HSTS header after cert is working:
# Strict-Transport-Security: max-age=31536000; includeSubDomains