What is the difference between DV, OV, and EV SSL certificates?

Domain Validated (DV) certificates verify only domain control (e.g. Let's Encrypt); Organization Validated (OV) verifies the registered business identity; and Extended Validation (EV) requires rigorous legal vetting of organizational existence.

What are Subject Alternative Names (SAN) in an SSL certificate?

Subject Alternative Name (SAN) is an X.509 extension allowing a single certificate to secure multiple hostnames and subdomains (e.g. example.com, www.example.com, api.example.com) under one public key.

Why are modern SSL certificate lifespans limited to 398 days?

The CA/Browser Forum mandated a maximum 398-day validity period (approx 13 months) to improve security agility, shorten the window of compromised private keys, and accelerate the transition to newer cryptographic algorithms like TLS 1.3.

X.509 Cryptographic TLS Diagnostic Engine

SSL / TLS Certificate & Expiry Inspector

Audit SSL/TLS certificate chains, Certificate Authority (CA) issuers, days until expiration, Subject Alternative Names (SAN), signature ciphers, and TLS 1.3 handshake latency in real time.

Target Hostname or Domain e.g. FQDN or apex domain

TLS Port (Default 443)

Examples: tech100.top cloudflare.com google.com github.com

Transport Layer Security Engineering Guide

Anatomy of X.509 SSL/TLS Certificates, CAs & Encryption

Transport Layer Security (TLS) forms the encryption backbone of the World Wide Web. Learn how digital certificate chains of trust, asymmetric key exchanges, automated ACME renewals, and modern TLS 1.3 protocol handshakes function.

RFC 8446 Specification

TLS 1.2 vs. Modern TLS 1.3 Handshake Speed & Security

TLS 1.3 eliminated obsolete ciphers (RSA key exchange, SHA-1, CBC modes) and shortened the handshake from two round trips (2-RTT) down to just one round trip (1-RTT) or zero round trips (0-RTT):

Protocol Property	TLS 1.2 (RFC 5246)	TLS 1.3 (RFC 8446)	Security Advantage
Handshake Latency	2 Roundtrips (2-RTT)	1 Roundtrip (1-RTT) / 0-RTT Resumption	Halves connection setup latency for mobile and high-RTT clients
Forward Secrecy (PFS)	Optional (Static RSA permitted)	Mandatory (Ephemeral Diffie-Hellman only)	Past recorded sessions cannot be decrypted if server private key is stolen
Permitted Ciphers	30+ suites (including insecure RC4, 3DES, CBC)	5 Authenticated Encryption (AEAD) suites only	Immune to POODLE, BEAST, LUCKY13 padding attacks
Handshake Encryption	Server certificates transmitted in plaintext	Certificate payload encrypted after ClientHello	Prevents passive network eavesdroppers from observing queried domain names

DV Certificate

Domain Validation

Verifies only control over domain DNS or web server (via ACME HTTP-01 or DNS-01 challenges). Issued automatically in seconds. Powering 90%+ of web encryption via Let's Encrypt and Cloudflare.

Standard for blogs, SaaS & APIs

OV Certificate

Organization Validation

The Certificate Authority verifies the legal corporate entity, business registry registration, physical operating address, and phone confirmation before certificate issuance.

Enterprise portals & intranets

EV Certificate

Extended Validation

Requires rigorous independent third-party legal auditing and lawyer verification of corporate identity. Provides maximum corporate identity transparency in certificate details.

Banking & financial institutions

SSL & TLS Knowledge Base

Frequently Asked Questions: SSL Expiry & Certificate Chains

In September 2020, Apple, Google, and the CA/Browser Forum reduced the maximum permitted SSL certificate lifetime from 825 days to 398 days (approx 13 months). Shorter certificate lifespans ensure that private key compromises have limited damage windows, and allow the industry to deprecate weak hash algorithms (like SHA-1) rapidly across the internet.

When a browser connects via HTTPS, it must check whether the certificate was revoked before its expiration date. Online Certificate Status Protocol (OCSP) Stapling allows the web server to periodically query the CA's OCSP server, cache the digitally signed revocation response, and "staple" it directly into the initial TLS handshake, eliminating extra DNS and HTTP roundtrips for every client.

SSL certificates rely on a hierarchical chain: Root CA → Intermediate CA → Leaf (Server) Certificate. If an intermediate certificate in the bundle expires (as occurred during the famous Sectigo AddTrust root expiration in 2020), legacy clients and embedded systems that lack updated root stores will reject the connection with CERT_HAS_EXPIRED errors even if the leaf certificate is completely valid.