We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design Masterclass · Security Architecture
Free preview: the first 2 parts of this 5-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Security Architecture
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
In February 2020, Microsoft Teams went down for hours because a TLS certificate expired. Millions of users could not access the platform. The fix was simple: renew the certificate. But the damage was done. An expired certificate means browsers refuse to connect, showing scary security warnings. Users cannot bypass them (nor should they). The service is effectively offline.
This was not a one-off. Spotify suffered a similar outage in August 2020. Equifax blamed an expired certificate for failing to detect their 2017 breach for 76 days because the SSL inspection appliance stopped working when its cert expired. Slack, LinkedIn, and the UK government's gov.uk have all had certificate expiry incidents.
Certificate management is not glamorous, but an expired cert is one of the most common causes of preventable production outages. Organizations with thousands of certificates across hundreds of services still get caught because manual tracking at scale is impossible.
The provider you pick determines your cost, automation options, and certificate types available.
Let's Encrypt is free, automated, and issues DV certificates with 90-day lifetimes. It handles over 300 million active certificates. Certbot is the standard client, but ACME clients exist in every language. The downside: no OV or EV certificates, and rate limits (50 certs per domain per week) can be restrictive for large organizations.
AWS Certificate Manager (ACM) is free for certificates used on AWS services (ALB, CloudFront, ). It handles issuance, renewal, and deployment automatically. The catch: ACM certificates cannot be exported. If you need the private key for a non-AWS server, you need a different provider.
DigiCert is the enterprise choice. They issue DV, OV, and EV certificates with SLAs, support contracts, and centralized management via CertCentral. Cost starts at $200/year for OV and goes up for wildcard and EV. Financial institutions and healthcare companies often require DigiCert or similar because compliance auditors want to see a commercial CA relationship.
Self-signed certificates are free and instant but are not trusted by browsers or external clients. Use them only for local development, internal testing, and internal mTLS between services where you control the trust store.