For a long time, discussions about the security of domains and web services have been reduced to a handful of buzzwords: SSL certificate, HSTS, HTTPS redirection, possibly preload analysis. In practice, however, anyone maintaining production environments knows that the real state of “trust” of a domain or service is much broader. It’s not just about […]
Encryption over HTTPS solves many problems, but one element has remained a critical vulnerability point for years: the moment when the browser still does not yet know whether it should use HTTPS. This stage precedes the actual TLS connection. It happens before the handshake is performed, before the certificate is verified and before the server […]
In the web security ecosystem, there is still a lack of tools that combine execution speed, result clarity and full automation of processes related to HTTPS and HSTS diagnostics. Classic solutions deliver only partial functionality or require complex integrations. In response to these limitations, HEXSSL-CLI was created, an official command line tool that introduces a […]
At the end of October 2025, Google announced one of the most significant changes to Chrome’s security policy in many years. Starting from version 154, which will be delivered to users in October 2026, the browser will enforce HTTPS connections by default. This means that Chrome will attempt to establish an encrypted connection to every […]
Implementing an SSL/TLS certificate is now an absolute standard for every website, web application, or API interface. However, simply having a certificate does not guarantee security. In practice, many implementations leave gaps that not only lower the level of protection but also affect the domain’s reputation, SEO, and compliance with regulations (e.g. NIS2, GDPR).
