toolsura

How SSL certificate chains link your site to a trusted root

dev_toolsura — Sat, 12 Sep 2026 17:01:21 GMT

TL;DR

An SSL certificate chain links your site to a trusted root via intermediates. Certs cap at 200 days and drop to 47 by 2029. Learn how to verify your chain.

Introduction

How SSL certificate chains link your site to a trusted root shows up everywhere but is usually explained in half-truths. Here's what it actually is, what it isn't, and why the difference matters.

From the original post:

An SSL certificate chain links your site to a trusted root via intermediates. Certs cap at 200 days and drop to 47 by 2029. Learn how to verify your chain.

What is an SSL certificate chain?
How do root, intermediate, and leaf certificates differ?
How does certificate chain verification work?
Why doesn't the CA sign your certificate with the root?
Cross-signed certificates: two valid chains for one site
What happens when a certificate chain breaks?
Certificate lifespans are collapsing: 200 days to 47 by 2029
How do you view and verify a certificate chain?
The bottom line: trust is a chain, not a certificate
Related Reading

What is an SSL certificate chain?

An SSL certificate chain, formally a certification path, is your certificate signed by an intermediate CA, which is itself signed by a root CA. RFC 5280, the X.509 standard that governs public key infrastructure, defines the path as "a certificate of the public key owner (the end entity) signed by one CA, and zero or more additional certificates of CAs signed by other CAs" (IETF, 2008).

How do root, intermediate, and leaf certificates differ?

The three tiers differ in where the private key lives, how long the certificate lasts, and who audits it. Mozilla's Root Store Policy v3.1, effective July 1, 2026, requires root inclusion to be backed by "an auditor-witnessed root key generation ceremony report," while intermediate CAs must be disclosed in the CCADB within 7 days of creation and before any issuance (Mozilla, 2026).

How does certificate chain verification work?

Verification is path building, and it runs on your visitor's machine. The client takes the leaf, looks up who signed it, checks that signature, then repeats the step for each issuer until it lands on a self-signed root from its local trust store. RFC 5280 Section 6.1 specifies this as the Basic Path Validation algorithm, and its Basic Constraints extension carries the pathLenConstraint field, which gives "the maximum number of non-self-issued intermediate certificates that may follow" a certific…

Why doesn't the CA sign your certificate with the root?

Because the root is the one key that must never touch the internet, and the intermediate is the one key designed to be thrown away. Mozilla's Root Store Policy forces roots through auditor-witnessed generation ceremonies precisely because there's no recovery if a root key leaks: no parent certificate exists to revoke it. A compromised root turns every certificate beneath it into suspect material until trust stores remove it, stranding millions of sites at once.

Cross-signed certificates: two valid chains for one site

A cross-signed certificate is one CA key holding certificates from two different parents, which creates two valid chains for the same site. Let's Encrypt puts the concept better than anyone: "a CA is most correctly thought of as a key and a name: any given CA may be represented by multiple certificates which all contain the same Subject and Public Key Information" ( Let's Encrypt, 2026).

What happens when a certificate chain breaks?

The classic broken chain is a missing intermediate, and the failure text is unmistakable. OpenSSL reports X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY, defined verbatim as "The issuer certificate could not be found: this occurs if the issuer certificate of an untrusted certificate cannot be found" ( OpenSSL's verification error reference ). In plain terms: your leaf says "signed by YE1," your server never sent YE1, and the client can't complete the path on its own.

Certificate lifespans are collapsing: 200 days to 47 by 2029

The shrinking validity schedule raises the stakes. At 200 days, then 100, then 47 by March 2029 ( CA/Browser Forum ), manual renewal stops being viable well before the 47-day mark. Every automated renewal is one more chance for a packaging slip, which is why a post-deploy chain check belongs in your pipeline.

How do you view and verify a certificate chain?

You can inspect any chain in under a minute using a browser, OpenSSL, or a zero-install checker. The openssl verify command accepts -untrusted for "certificates to use for chain building" and -show_chain to print the path it built, letting you replicate a browser's decision locally.

The bottom line: trust is a chain, not a certificate

An SSL certificate chain is the mechanism that turns a stranger's public key into a trusted identity. Leaf, intermediates, root: each signature vouches for the next, and the path ends in a root your visitor already carries. Roots stay offline for a decade or more, intermediates stay online and revocable, and leaves keep getting shorter, with 200 days now and 47 coming by 2029. When one link goes missing, the failure is loud and unambiguous, so verify after every renewal. Sixty seconds with ToolS…

Code Examples

+---------------------+
|  Root CA            |  ISRG Root X1: lives in your OS or browser
|  (self-signed)      |  trust store; offline key; decades of life
+----------+----------+
           | signs
+----------v----------+
|  Intermediate CA    |  e.g. Let's Encrypt YE1: online key;
|                     |  revocable; disclosed in the CCADB
+----------+----------+
           | signs
+----------v----------+
|  Leaf certificate   |  www.example.com: scoped to your
|                     |  domain, short-lived
+---------------------+

Default RSA chain:   your certificate <- YR1 <- Root YR <- ISRG Root X1
Default ECDSA chain: your certificate <- YE1 <- Root YE <- ISRG Root X2 <- ISRG Root X1

FAQ

What is an SSL certificate chain?

How do root, intermediate, and leaf certificates differ?

How does certificate chain verification work?

Why doesn't the CA sign your certificate with the root?

What happens when a certificate chain breaks?

How do you view and verify a certificate chain?

Key Takeaways

A chain runs leaf, then intermediate, then root. Browsers trust your certificate only if the path ends at a root already in their trust store.
Servers send the leaf and intermediates, never the root. The client completes the path on its own.
The classic chain break is a missing intermediate, surfacing as "unable to get local issuer certificate."
Maximum validity drops to 200 days in March 2026 and 47 days by 2029 (CA/Browser Forum), so automated chain handling is becoming mandatory.

Continue Learning

Read the full guide: https://www.toolsura.com/blog/what-is-an-ssl-certificate-chain/

What CMS Does This Website Use? 8 Checks for Any Site

dev_toolsura — Thu, 10 Sep 2026 18:16:22 GMT

Find what CMS any website uses in under 2 minutes with 8 free view-source signatures covering WordPress, Shopify, Wix, Squarespace, Webflow, and Drupal.

Introduction

What CMS Does This Website Use shows up everywhere but is usually explained in half-truths. Here's what it actually is, what it isn't, and why the difference matters.

From the original post:

Find what CMS any website uses in under 2 minutes with 8 free view-source signatures covering WordPress, Shopify, Wix, Squarespace, Webflow, and Drupal.

The quick answer to "what cms does this website use"

You can answer what cms does this website use for most sites in under two minutes without installing anything. Right-click, choose View Page Source, then search for the platform signatures below. Asset paths are the fastest tell because nearly every CMS organizes uploads and scripts into recognizable directories. WordPress alone accounts for 40.7% of all websites and a 58.9% share of the CMS market in the W3Techs survey updated August 30, 2026, which is why its signatures dominate this list. Thi…

Which CMSs are you actually looking at?

Knowing the odds sharpens every guess. WordPress powers 40.7% of all websites, which is a 58.9% share of the CMS market, per W3Techs as of August 2026. Those two percentages use different denominators, so keep them straight: one divides by every site on the relevant web, the other only by sites running a CMS that W3Techs can identify. Conflating them is the single most common error in CMS statistics.

Per-platform signatures at a glance

/wp-content/

The 30-second checks, in order

Read response headers (Server, X-Powered-By)

A worked example with real output

We ran the two strongest checks against techcrunch.com while writing this guide (verified August 2026), and both signals agreed. , no generator meta tag appeared in the source, which shows why relying on any single signal fails: the asset paths carried the identification alone.

Builder platforms hide differently

Wix, Squarespace, and Webflow sites rarely expose directory structures because everything loads from the vendor's own domains. That actually makes them easier to spot: check where the stylesheets and images come from. A stylesheet pulled from a squarespace or wixstatic domain answers the question instantly. These platforms also lock URL structures, which shows up in the address bar itself.

The self-hosted long tail: Drupal, Joomla, Ghost

Self-hosted CMSs beyond WordPress follow the same directory conventions, just with their own names. Drupal sites commonly expose /sites/default/files in their asset URLs, and current production releases sit at 11.4.5, which describes as ready for production use with security coverage until June 2027. Joomla deployments expose /media/ and /components/com_ paths, with older Joomla 3 sites still showing the legacy /media/jui/ layout; the Joomla project site offers 6.1.3 as the latest stable release…

When a site hides its CMS

Hardened sites rename asset directories, strip generator tags, and disable API routes specifically to defeat these checks; as MDN notes on server identification, minimizing exposed implementation details is a recognized hardening practice. When every direct signal comes up empty, indirect signals still help: the sitemap protocol files at robots.txt and sitemap.xml often retain platform-shaped paths even after cosmetic hardening, and hosting fingerprints from an IP lookup narrow the platform fami…

Why people ask this question

The motive shapes how deep to dig. Competitor research wants the platform to estimate costs and flexibility. Job applicants want to know which skills a role actually touches. Site owners migrating want to know what they are moving away from. Security researchers document exposed versions responsibly. In every case the manual checks above answer the question faster than signing up for a scanner, and the roundup of the best tools to detect website technologies covers when automated scanning earns …

Common detection mistakes to avoid

The migration trap catches the most people: sites move platforms and leave old asset URLs behind in cached pages, older posts, and third-party embeds. A wp-content URL on an otherwise un-WordPress-looking site deserves suspicion rather than instant verdicts.

Checking any site's CMS from here on

To find what cms does this website use: open the source, read the generator tag, search for signature asset paths, and confirm with a second signal such as the wp-json endpoint or an asset domain. Remember the odds: WordPress holds 58.9% of the CMS market per, so it is the rational first guess, yet 30.9% of sites run no monitored CMS at all. Builder platforms reveal themselves through their static-asset domains, hardened sites resist politely, and the whole check costs nothing but a minute of at…

FAQ

Which CMSs are you actually looking at?

Continue Learning

Read the full guide: https://www.toolsura.com/blog/what-cms-does-this-website-use/

CSS Gradients: The Complete Technical Guide to linear-gradient, radial-gradient, and conic-gradient

dev_toolsura — Fri, 14 Aug 2026 15:41:58 GMT

A CSS gradient is a browser-generated that interpolates between two or more colors across a spatial range. You declare it as a single property value, and the browser paints every pixel of the fade at render time — no bitmap to download. The CSS Images Module Level 4 spec standardizes the data type and its interpolation rules, and MDN's gradient reference documents the function set.

This guide covers the three gradient functions, the color-stop model that underpins all of them, and the techniques — stacking, repeating, masking, and background-clip: text — that go beyond the plain backdrop.

The data type and where gradients are valid

A gradient is a value of type , which is a special kind of . Because it's an image, it's valid anywhere an image is — the most common being background-image and the background shorthand, but also border-image, mask-image, and the content property. This is why gradients aren't limited to backgrounds: wherever an image works, a gradient works.

The underlying concept is a color ramp — a progression that interpolates between defined colors across a spatial range, a notion that predates CSS by decades (see Wikipedia: color gradient). CSS promotes it to a first-class value type.

The two practical payoffs: a gradient scales to any dimension without blurring (the browser redraws it at the element's resolution rather than sampling a fixed bitmap), and it ships zero image bytes — a few dozen characters in your stylesheet instead of a JPG/PNG and an HTTP request. Editing is a hex-value change, not a re-export.

The three gradient functions

CSS provides exactly three gradient-producing functions. Choosing between them is a question of shape — how the transition travels.

`linear-gradient()` — straight axis

Blends colors along a straight line. Direction is set by an angle (45deg, 135deg) or a keyword (to right, to top right), followed by the color stops.

background: linear-gradient(to right, #ff7e5f, #feb47b);
background: linear-gradient(135deg, #6366f1 0%, #ec4899 100%);

Linear is the default workhorse: hero backdrops, button fills, card overlays, section dividers. The default direction (no argument) is top to bottom.

MDN: linear-gradient() — direction keywords and angle units.

`radial-gradient()` — outward from a center

Spreads colors outward from a center point in a circle or ellipse. The fade tracks distance from a point, which is why radial gradients read as depth and light.

background: radial-gradient(circle, #fff, #000);
background: radial-gradient(circle at 30% 30%, #fff, #000);

Control surface:

Shape: circle or ellipse.
Center position: e.g. at 30% 30%.
Size keywords: closest-side, closest-corner, farthest-side, farthest-corner.

Radial is the tool for spotlights, glows, and vignettes.

MDN: radial-gradient()

`conic-gradient()` — rotational sweep

Rotates colors around a center point; the transition sweeps by angle instead of distance. This is the distinguishing feature — and the reason conic is the right tool for pie charts, color wheels, and loading spinners.

background: conic-gradient(#f00 0 25%, #0f0 25% 50%, #00f 50% 75%, #ff0 75%);

Conic is the newest of the three and the least used, which makes it the most likely to surprise. Note it arrived in browsers later than linear and radial — check the specific function if you support older targets.

MDN: conic-gradient()

Everything else you'll encounter — repeating variants, mesh backgrounds, striped patterns — is a variation on these three.

Color stops and interpolation

A color stop is a plus an optional position (a percentage or length). The browser interpolates smoothly between adjacent stops. Omit positions and colors distribute evenly across the range; add them and each color sits exactly where you place it.

background: linear-gradient(135deg, #6366f1 0%, #8b5cf6 50%, #ec4899 100%);

The part that catches people: two stops at the same position produce a hard edge, not a fade:

background: linear-gradient(to right, #000 50%, #fff 50%);
/* clean half-and-half split, no image file needed */

That single rule is the mechanism behind every striped and banded gradient in CSS. The CSS Images Level 4 spec defines this precisely, including how the browser handles stops declared out of order (they're adjusted so each stop's position is at least as large as the previous).

Stacking: multiple gradients on one element

The image properties accept a comma-separated list, and the browser stacks them front to back — the first listed sits on top. When upper layers use transparency, lower layers show through.

background:
  linear-gradient(rgba(0,0,0,0.4), transparent),   /* tint, drawn on top */
  linear-gradient(to right, #6366f1, #ec4899);        /* base gradient */

This is the canonical overlay pattern: a transparent dark layer fades over a colorful base so overlaid text stays readable. Each layer is an independent gradient with its own stops; reordering the list reorders the stack. Mesh backgrounds and subtle texture overlays are built this way from pure CSS.

Repeating gradients

repeating-linear-gradient() and repeating-radial-gradient() take the same syntax as their base functions but tile the stop pattern across the box instead of stretching it once. The pattern repeats as soon as the last stop's position is reached — so the spacing between stops is the stripe width.

/* Diagonal stripes */
background: repeating-linear-gradient(45deg, #6366f1 0 20px, #ec4899 20px 40px);

/* Concentric rings */
background: repeating-radial-gradient(circle, #fff 0 10px, #000 10px 20px);

A two-stop gradient becomes stripes, checks, or concentric rings with no image file — the CSS way to draw patterns.

Gradients beyond `background`

Because a is an , it's valid in any image-valued property. Three techniques follow from that:

Gradient text — `background-clip: text`

Paint the gradient as a background, then clip it to the shape of the text glyphs:

background: linear-gradient(to right, #6366f1, #ec4899);
-webkit-background-clip: text;
background-clip: text;
color: transparent;

Keep the underlying text readable if the gradient fails to paint — pairs with a sensible color fallback and, for accessibility, ensure the text's color meets contrast on the page's background if the clip doesn't apply.

Fade to transparent — the overlay primitive

Using rgba() (or any color with an alpha channel) you can fade an element to readable darkness or blend two sections cleanly. This is the simplest and most-used overlay pattern in CSS.

Gradient borders

border-color only accepts solid colors, so gradient borders need border-image, a wrapper element, or a mask trick. There's no single clean property; each is a documented workaround.

Browser support

Modern gradient syntax is safe to ship unprefixed. caniuse's css-gradients table shows near-universal coverage for linear and radial — they've shipped unprefixed in every major browser for over a decade. Vendor prefixes are only needed for very old versions most sites no longer target. Conic gradients arrived later than linear and radial, so verify the specific function if you support older browsers, but in current browsers it's fully supported.

Rendering performance

The rule of thumb to hold onto: gradients beat background images on load time, and lose to solid colors on paint time.

Static gradients on normal-sized elements paint once and cost nothing measurable.
Gradients that animate, cover a huge surface, or stack many layers can tax the paint step — a common source of jank on large/animated hero sections, especially on lower-end devices.

A specific gotcha: gradient values do not interpolate between keyframes by default. You can't transition or @keyframes-animate the gradient value itself. The standard workarounds are:

Animate background-position on an oversized gradient (set background-size: 200% 200%, then move the position).
Register a @property custom property so the browser has an animatable value to interpolate against.

Heavy gradient animation remains a paint-cost risk on large elements either way. For profiling and mitigations, see the gradient performance guide.

FAQ

Are CSS gradients supported in all browsers? For practical purposes, yes. Linear and radial have been unprefixed in every major browser for 10+ years; conic is fully supported in current browsers but arrived later (verify for old targets). Prefixes are only for legacy versions most sites no longer support.

Are gradients faster than background images? Usually. A gradient adds zero image bytes, needs no extra HTTP request, and stays sharp at every size because the browser redraws it. The tradeoff is paint cost on very large or animated surfaces.

How many color stops can a gradient have? No fixed limit; minimum two. Each stop is a color plus an optional position. Two stops at the same position create a hard edge — that's how striped and banded patterns are built.

Can you animate a CSS gradient? Not directly — gradient values don't interpolate between keyframes by default. Animate background-position on an oversized gradient, or register a @property custom property. Heavy gradient animation strains paint, so track frame cost on large elements.

CLI for SEO: Efficiently Resolving "Discovered: Currently Not Indexed" with gsc-indexer

dev_toolsura — Sat, 01 Aug 2026 17:13:02 GMT

Understanding "Discovered currently not indexed"

For many developers and SEOs, the "Discovered - currently not indexed" status in Google Search Console (GSC) is a familiar, frustrating sight. It means Google knows about your page but has chosen not to crawl or index it yet. This can delay critical content from appearing in search results.

While this status can stem from various factors (crawl budget, content quality, site errors), a common strategy is to explicitly request indexing through the GSC URL Inspection API. Manually doing this for hundreds or thousands of URLs is impractical. This guide explores how gsc-indexer, a command-line utility, addresses this at scale.

Bulk Indexing with `gsc-indexer`

gsc-indexer is designed for developers who need to manage Google Search Console indexing requests programmatically. It integrates smoothly into existing CLI workflows, supporting various input methods for batch processing.

1. Batch File Input

The most straightforward way to submit multiple URLs is via a batch file. Create a simple text file (urls.txt) where each line contains a single URL you want to inspect or request indexing for. Lines starting with # are ignored.

# urls.txt
https://www.your-domain.com/new-article-1/
https://www.your-domain.com/updated-product-page/
https://www.your-domain.com/blog/important-announcement/

Then, execute gsc-indexer with the -batch flag:

gsc-indexer -batch urls.txt -sa service-account.json -p https://www.your-domain.com/

This command reads urls.txt, processes each URL, and sends requests via your authenticated service account for the specified GSC property.

2. Piped Standard Input (stdin)

gsc-indexer excels in Unix-like environments by supporting piped standard input. This enables dynamic URL lists from other tools. For example, to index all blog posts from your sitemap:

curl -s https://www.your-domain.com/sitemap.xml | \
grep -oE 'https://www.your-domain.com/blog/[^<]+' | \
gsc-indexer -json -sa service-account.json -p https://www.your-domain.com/ -batch /dev/stdin > indexing-results.json

Here, curl fetches the sitemap, grep extracts blog post URLs, and the pipe (|) feeds these directly into gsc-indexer. The -batch /dev/stdin flag explicitly tells the tool to read from standard input. The -json flag ensures machine-readable output.

3. Sitemap URL Processing

If your entire sitemap needs processing, gsc-indexer can handle it directly. Provide the sitemap URL with the -sitemap flag:

gsc-indexer -sitemap https://www.your-domain.com/sitemap.xml -sa service-account.json -p https://www.your-domain.com/

This command fetches the sitemap, recursively resolves any sitemap indexes, extracts all entries, and processes them. Note that expansion is capped at 50,000 URLs to prevent excessive API usage.

Combining Input Methods & Deduplication

gsc-indexer can combine multiple input sources in a single run. For instance, you can provide a batch file, pipe URLs from stdin, and specify a sitemap URL. The tool automatically merges all inputs and removes duplicate URLs before processing.

gsc-indexer -batch critical-urls.txt -sitemap https://www.your-domain.com/sitemap.xml -sa sa.json -p https://www.your-domain.com/

This ensures you only send unique requests, optimizing your daily GSC API quota.

Conclusion

Leveraging gsc-indexer for bulk URL inspection and indexing requests transforms a tedious manual task into an automated, scalable process. By integrating this CLI tool into your development or deployment workflows, you can proactively address indexing issues and ensure your content gets the visibility it deserves in Google Search.

CTA: Take control of your indexing strategy. Explore the full gsc-indexer documentation and get started today.

toolsura

How SSL certificate chains link your site to a trusted root

TL;DR

Introduction

Table of Contents

What is an SSL certificate chain?

How do root, intermediate, and leaf certificates differ?

How does certificate chain verification work?

Why doesn't the CA sign your certificate with the root?

Cross-signed certificates: two valid chains for one site

What happens when a certificate chain breaks?

Certificate lifespans are collapsing: 200 days to 47 by 2029

How do you view and verify a certificate chain?

The bottom line: trust is a chain, not a certificate

Related Reading

Code Examples

FAQ

What is an SSL certificate chain?

How do root, intermediate, and leaf certificates differ?

How does certificate chain verification work?

Why doesn't the CA sign your certificate with the root?

What happens when a certificate chain breaks?

How do you view and verify a certificate chain?

Key Takeaways

Continue Learning

What CMS Does This Website Use? 8 Checks for Any Site

Introduction

The quick answer to "what cms does this website use"

Which CMSs are you actually looking at?

Per-platform signatures at a glance

The 30-second checks, in order

A worked example with real output

Builder platforms hide differently

The self-hosted long tail: Drupal, Joomla, Ghost

When a site hides its CMS

Why people ask this question

Common detection mistakes to avoid

Checking any site's CMS from here on

FAQ

Which CMSs are you actually looking at?

Continue Learning

CSS Gradients: The Complete Technical Guide to linear-gradient, radial-gradient, and conic-gradient

The data type and where gradients are valid

The three gradient functions

linear-gradient() — straight axis

radial-gradient() — outward from a center

conic-gradient() — rotational sweep

Color stops and interpolation

Stacking: multiple gradients on one element

Repeating gradients

Gradients beyond background

Gradient text — background-clip: text

Fade to transparent — the overlay primitive

Gradient borders

Browser support

Rendering performance

FAQ

Further reading and tools

CLI for SEO: Efficiently Resolving "Discovered: Currently Not Indexed" with gsc-indexer

Understanding "Discovered currently not indexed"

Bulk Indexing with gsc-indexer

1. Batch File Input

2. Piped Standard Input (stdin)

3. Sitemap URL Processing

Combining Input Methods & Deduplication

Conclusion

`linear-gradient()` — straight axis

`radial-gradient()` — outward from a center

`conic-gradient()` — rotational sweep

Gradients beyond `background`

Gradient text — `background-clip: text`

Bulk Indexing with `gsc-indexer`