Master Digital Certificates
Build Trust in a
Digital-First World

Issuing a certificate is only half of the trust equation. The other half is being able to un-trust it before its natural expiration, if something goes wrong. Certificate Revocation Lists are one of the two primary mechanisms, alongside OCSP covered elsewhere in this series, that make revocation actually enforceable rather than merely theoretical. This article explains what a CRL is, how it works, and where it still fits into a modern PKI.

Every PKI eventually has to answer the same operational question: when a client needs to know whether a certificate has been revoked, how does it find out, quickly, reliably, and without unnecessary overhead? Certificate Revocation Lists, covered in depth elsewhere in this series, were the original answer. The Online Certificate Status Protocol, OCSP, emerged as a more real-time alternative. This article compares the two directly and looks at where each fits in a modern PKI.

Revocation is the emergency brake of the certificate world, and like any emergency brake, its value depends entirely on people knowing when to actually pull it. Too hesitant, and a compromised certificate stays trusted far longer than it should. Too trigger-happy, and legitimate services get disrupted unnecessarily. This article covers the situations that genuinely call for revocation, and the reasoning behind each one.

Passwords have been the default authentication method for decades, and they have also been a persistent source of breaches, phishing losses, and help desk tickets for exactly as long. Certificate-based authentication offers a genuinely different approach: instead of proving identity with something memorized, an entity proves identity with something cryptographically possessed. This article looks at how certificate-based passwordless authentication actually works and why organizations are increasingly adopting it.

Node.js powers a huge share of modern web backends, APIs, and increasingly the orchestration layers behind AI-driven services, which makes handling certificates correctly inside a Node.js application a genuinely common and consequential task. This article covers the practical patterns for working with certificates across Node.js applications, from serving HTTPS traffic to authenticating outbound requests.

Continuous integration and continuous deployment pipelines have become the place where a huge share of an organization\’s software, infrastructure, and increasingly AI-driven services gets built and shipped. Certificates need to move through these pipelines securely and reliably, without becoming either a security liability or a deployment bottleneck. This article covers the best practices for handling certificates well inside CI/CD workflows.

A certificate can be cryptographically perfect, correctly signed, properly formatted, and still be worthless if nothing trusts the entity that signed it. Trust in the certificate world is not an inherent property of a certificate; it is inherited, link by link, through a structure called the chain of trust. This article explains exactly how that chain works and what actually makes a certificate trusted.