TLS Certificates: Everything That Can Go Wrong (and Why mTLS Is Becoming the Standard for Serious Stuff) A complete guide to digital certificates in 2026 — from the basics that still break production to mTLS that's becoming mandatory for serious APIs and CDN integrations.
TLS Certificates: Everything That Can Go Wrong (and Why mTLS Is Becoming the Standard for Serious Stuff) A complete guide to digital certificates in 2026 — from the basics that still break production to mTLS that's becoming mandatory for serious APIs and CDN integrations. Introduction If you manage anything on the internet, you've been through this: the client calls complaining that "the site is showing a security error", you open the browser and see that red screen. Expired certificate. Invalid certificate. Certificate for another name. And always on a Friday afternoon. TLS certificates are one of those things that seem simple until you need to touch them. And here's the point: certificates aren't just for HTTPS. In 2026, they're the foundation of practically all modern authentication on the internet. mTLS is becoming the standard for APIs between systems. Cloudflare, AWS, Google, and Azure are pushing certificate-based authentication for serious integrations. Service mesh uses certificates to authenticate service-to-service. Zero Trust depends on certificates to identify devices. Part 1: How TLS Really Works 1.1 What TLS Solves Three things: Confidentiality — nobody on the path can read Integrity — nobody can modify without being detected Authenticity — you talk to who you think you're talking to The first two are solved by symmetric cryptography. The third is the hard problem: how do you share a secret key with someone you've never met over a potentially hostile network? The answer: digital certificates and asymmetric cryptography . 1.2 The TLS Handshake, Simplified Browser connects and says "I want to speak TLS, I support these versions" Server responds with its chosen version and its certificate Browser verifies the certificate (trusted CA? valid? name matches?) Both do math exchange (ECDHE) to derive a unique session key From then on, everything is encrypted symmetrically The magic is in step 4: using elliptic curve Diffie-Hellman, both sides arrive at the same secret key without ever transmitting it on the wire. 1.3 What's Inside a Certificate Owner's name (CN and SANs) Public key Who issued it (CA) Validity period CA's digital signature The browser/OS "trust store" contains the pre-installed trusted CAs. 1.4 The Certificate Chain The server needs to send certificate leaf + intermediates . Forgetting this is one of the most common errors: it works in Chrome (which has a cache) but breaks in curl or Firefox. Always use fullchain.pem. Part 2: Certificate Types 2.1 By Validation DV (Domain Validation) — only verifies control of the domain. Automated, free (Let's Encrypt). Sufficient for 99% of cases. OV (Organization Validation) — verifies that the company exists. Asks for CNPJ, phone, address. Time: 1-5 days. Cost: tens to hundreds of dollars. EV (Extended Validation) — extended validation. In 2026, browsers no longer show a differentiated green bar . EV became a compliance requirement, not visual differentiation. 2.2 By Scope Single domain — one name only. Wildcard — .empresa.com.br covers all direct subdomains. Does not cover the root domain or subdomains of subdomains. Let's Encrypt issues via DNS-01. Multi-Domain (SAN) — specific list of names. Let's Encrypt supports up to 100 SANs. 2.3 By Use TLS Server Authentication — standard TLS Client Authentication — used in mTLS Code Signing — sign binaries S/MIME — sign and encrypt emails Part 3: Certificate Authorities Today 3.1 Let's Encrypt The revolution. Today it issues more than half of all public certificates on the internet. Free Total automation via ACME Wildcards via DNS-01 90-day validity (intentional — forces automation) 3.2 ZeroSSL Free alternative to Let's Encrypt. Also ACME. Useful for diversification. 3.3 Google Trust Services Google issuing publicly since 2022. Free for Google Cloud customers. 3.4 Classic Commercial CAs DigiCert, Sectigo, GlobalSign, Entrust. Who still buys: companies with required OV/EV, long validity, commercial SLA, special certificates. 3.5 Private CAs You can run your own. For internal mTLS, IoT, service mesh, private infrastructure. Tools: HashiCorp Vault with PKI engine step-ca (Smallstep) — easy, supports ACME EJBCA — complex enterprise cfssl (Cloudflare) Part 4: Everything That Can Go Wrong 4.1 Expired Certificate The classic. It already happened to Microsoft Teams, LinkedIn, Spotify, Cisco, Ericsson, everyone. Root cause: someone installed manually, reminder got lost, person left, nobody knew. How to avoid: Total automation (Let's Encrypt + ACME) Centralized inventory Alerts at 60/30/14/7 days Multiple alert channels Don't depend on one person only 4.2 Incomplete Chain Works in Chrome, breaks in curl. Symptom: client swears it doesn't work and you can't reproduce it. Solution: always fullchain.pem. 4.3 Hostname Mismatch Certificate for www.empresa.com.br but someone accesses empresa.com.br. Include all SANs. 4.4 SHA-1 or Weak Ciphers Minimum acceptable in 2026: Signature: SHA-256+ RSA: 2048 bits+ (4096 better) EC…