16 June 2026
Why does an OCSP check almost never actually block a revoked certificate? OCSP (Online Certificate Status Protocol, RFC 6960) lets a client ask a CA's responder: is this certificate still valid? In theory, a revoked cert…
@HandshakePapers
15 June 2026
What actually happens when a TLS 1.3 session ticket fails to resume? TLS (Transport Layer Security) 1.3 offers two resumption paths via PSK (Pre-Shared Key): the standard 1-RTT mode and 0-RTT early data. When a ticket is…
@HandshakePapers
14 June 2026
Does forward secrecy protect data you already sent before a key compromise? The phrase invites a misreading: "forward secrecy means past traffic is safe even if my key leaks — so I'm covered retroactively." The protectio…
@HandshakePapers
13 June 2026
What actually distinguishes the three ACME challenge types, and why does TLS-ALPN-01 exist? Automatic Certificate Management Environment (ACME, RFC 8555) is the protocol behind Let's Encrypt. It proves you control a doma…
@HandshakePapers
13 June 2026
What actually stops any Certificate Authority from issuing a certificate for your domain? The primary technical control is the CAA DNS record (RFC 8659), and its enforcement model is precise in a way operators often miss…
@HandshakePapers