分类
证书与 PKI
本分类下的所有工具与文章，集中在一处。
工具
证书续期规划器
计算 TLS 证书的有效期、是否符合 CA/Browser Forum 的 47 天时间表，以及由此带来的续期频率；全部离线运行。
ACME dns-01 TXT computer
Compute the TXT record for an ACME dns-01 challenge, from the token and account key.
CSR 解码器
在浏览器中完整解码 PKCS#10 证书签名请求，读取其主题、公钥、请求的 SAN 和扩展，以及属性。
Let's Encrypt rate-limit planner
Plan certificate issuance for a set of hostnames: group them by registered domain and see how they map onto Let's Encrypt's rate limits.
X.509 证书解码器
粘贴 PEM、base64 或 hex 证书以读取其主题、颁发者、有效期窗口、公钥和 v3 扩展，并附带 SHA-256 和 SHA-1 指纹。完全在你的浏览器中运行。
文章
X.509 证书的解剖
一个 TLS 证书内部活着什么、ASN.1/DER 字节如何构造、v3 扩展实际控制什么，以及为何解码一个证书与信任它并不相同。
阅读PEM、DER 与证书文件格式
为何同一份证书以如此多的文件形态出现、PEM 与 DER 实际是什么，以及 .crt、.pem、.pfx 与 .p12 真正持有什么。
阅读证书签名请求与证书如何被颁发
一份 CSR 包含什么、为何你的私钥从不离开你的机器、一个 CA 如何验证并颁发，以及 ACME 如何自动化整个交换。
阅读证书验证实际如何运作
一个客户端为判定一份证书可信而运行的步骤：构建链、核查签名与日期、匹配名字，以及强制约束。
阅读证书吊销：CRL、OCSP 与短寿命证书
为何一份证书有时需在其过期之前被取消、为何经典的吊销系统运作不佳，以及为何业界转而缩短证书的寿命。
阅读Authority Information Access: The OCSP and CA Issuers URLs
The AIA extension carries two kinds of pointer: where to ask whether a certificate is revoked (OCSP) and where to fetch the issuer's own certificate (CA Issuers). What each is for, why they are easy to confuse, and what the inspector shows.
阅读OCSP Must-Staple: Closing the Soft-Fail Gap
Real-time OCSP checking has a fatal weakness: when the responder is unreachable, clients usually proceed anyway. OCSP stapling and the Must-Staple flag are the fix. What the TLS Feature extension declares, and the operational risk it carries.
阅读ACME: how certificates issue and renew themselves
How the ACME protocol automates certificate issuance end to end: the account, the order, the three challenge types, the dns-01 record you publish, and the finalize-and-download step that produces the certificate.
阅读The 47-day era: how TLS certificate lifetimes are shrinking
The CA/Browser Forum's SC-081v3 schedule takes maximum public TLS validity from 398 days down to 47 by 2029, in three steps. What the phases are, why 47, and what it does to renewal volume.
阅读Certificate validity windows: notBefore, notAfter, and renewal lead time
How a certificate's lifetime is defined by two timestamps, how that length is measured against the cap, why validity is not the same as time remaining, and how to choose a renewal lead time.
阅读Let's Encrypt: the free CA and its rate limits
What Let's Encrypt is, why its certificates are short-lived, and how its rate limits actually work: the per-registered-domain and per-account limits, the exact-set and authorization-failure limits, and why ARI renewals are exempt from all of them.
阅读DCV and SII reuse: the validation cadence behind the renewal cadence
Issuing a certificate means proving domain control and, for OV/EV, organization identity. SC-081v3 shrinks how long those proofs can be reused — DCV to 10 days by 2029 — which reshapes renewal as much as validity does.
阅读Renewing before expiry: lead time, ACME, and ARI
Why late renewal causes outages, how ACME automates issuance and renewal, how the ARI extension lets a CA steer the renewal window, and how to pick a lead time that leaves room to retry.
阅读Public vs private PKI: which certificates SC-081v3 governs
The 47-day schedule binds publicly trusted TLS certificates only. What separates public from private PKI, why internal CAs are exempt, and how to read the planner's compliance verdict for an internal certificate.
阅读