Let's Encrypt is moving to 45-day certificates by February 2028, a full year before the industry mandate. Authorization reuse drops to 7 hours. If your renewals aren't truly automated, you'll find out the hard way. www.certkit.io/blog/45-day-... #PKI #CertificateManagement

One API key with access to everything is fine until a contractor leaves or a key leaks. CertKit now supports multiple applications with scoped API keys. Your marketing site automation never sees production infrastructure. www.certkit.io/blog/applica... #PKI #CertificateManagement

Every service wants DNS validation for certificates. With 47-day lifetimes coming, that means dozens of systems holding credentials that can modify your entire zone. CNAME delegation is the fix: one record, no credentials exposed. www.certkit.io/blog/delegat... #PKI #ACME

We published the CertKit roadmap. Unlike most company roadmaps, it's not vague promises about AI-powered synergies. It's a list of features with vote buttons. Tell us what you actually need. www.certkit.io/blog/what-sh... #CertificateManagement #PKI

"Free certificates? For production?" Yes. Let's Encrypt uses the same encryption as that $500 EV cert. Chrome killed the green bar in 2018. Amazon, Netflix, and Walmart all use DV certs. Your objections are probably institutional habit, not evidence www.certkit.io/blog/should-... #PKI #WebSecurity

DNS-01 validation requires changing TXT records on every certificate renewal. With 47-day lifetimes coming, that's going to hurt. DNS-PERSIST-01 fixes it: validate once, get certs forever. www.certkit.io/blog/dns-per... #ACME #PKI

Do you still need wildcard certificates? Wildcard vs SAN assumes certificates are painful to manage. But once you've automated for 47-day lifetimes, issuing 50 certs takes the same effort as one. The question shifts to security, not convenience. www.certkit.io/blog/do-you-... #PKI #WebSecurity

CertKit now supports multi-domain certificates. Mix wildcards with specific hostnames on a single cert. Also shipped: actual ACME error messages instead of "something went wrong" and non-sequential IDs to stop enumeration attacks. www.certkit.io/blog/certkit... #SSL #PKI

In 2015, only 40% of websites used HTTPS. Today it's 95%. The ACME protocol made that happen by automating certificate issuance. But it didn't solve certificate operations. That's still your problem. www.certkit.io/blog/how-acm... #ACME #PKI

Just got our last certificate renewal email ever. All our products are now fully automated with CertKit. No more $144/year wildcard certs. No more renewal reminders. No more "your site will be vulnerable" scare tactics. Dogfooding feels so good. #SSL #PKI

The NSA recorded encrypted traffic for years, betting they'd eventually steal your private keys. With RSA key exchange, that worked. PFS broke their playbook. If you're still on TLS 1.2 without ECDHE, your traffic from 2019 might get decrypted tomorrow. www.certkit.io/blog/perfect... #TLS #PKI

How do you store 3 billion SSL certificates on a 2.5TB drive and query them in under 100ms? Clickhouse. Final part of our CT search series covers the database tricks that make it work. www.certkit.io/blog/searchi... #Clickhouse #PKI

Most JavaScript errors in your monitoring dashboard are garbage. Browser extensions, ad blockers, crawlers. Here's how I set up TrackJS to ignore the noise and only alert on real bugs that matter. www.youtube.com/watch?v=HBaZ... #javascript #errormonitoring

Eric Brandes just dropped Part 2 of our CT logs deep dive. Tiled logs process 100M+ records/day vs RFC 6962's measly millions. Google throttles you to death, Cloudflare's better, Let's Encrypt's tiled logs are best. www.certkit.io/blog/searchi... #PKI #CertificateTransparency

Certificate Transparency logs contain billions of certificates but searching them is painful. crt.sh is slow and often down. So we built our own free CT search tool that actually works. Part 1 of our series: www.certkit.io/blog/searchi... #CertificateTransparency #PKI

"Revoke Certificate" - It's theater. Most revoked certs keep working. Chrome, Firefox, Safari each block different revoked certs. The industry knows it's broken, so they're forcing 47-day expiration instead. www.certkit.io/blog/certifi... #PKI #CertificateManagement

You know about Certificate Transparency logs, right? Right?! community.ops.io/certkit/how-...

Stripe bought their domain in 2010. The previous owner's SSL certificate was valid until 2011. For an entire year, someone else had a perfectly legitimate certificate for their payment processing. This is why we're getting 47-day certificates. www.certkit.io/blog/bygones...

Netflix doesn't join standards bodies. They build streaming protocols, not bureaucracy. #ssl

Welcome to #CertKit on #OpsMatters! CertKit gives you one dashboard to see every cert, every renewal, every domain—before they expire and ruin your weekend. #cybersecurity #certificatemanagement #devops https://opsmtrs.com/46V2Oar

"Nice website you got there. Shame if it was “Not Secure.” That’ll be $300 a year." www.certkit.io/blog/47-day-...

It started as 47 beautiful lines of bash. Now it's a distributed certificate system built on thousands of command line incantations nobody understands, running on every server, and some of the printers. www.certkit.io/blog/why-you... #devsecops #ssl #certificates

I had a fantastic time chatting with @richcampbell.bsky.social about Certificate management (specifically how much it sucks) and how we're trying to make it better at @certkit.io. Do you have strong feels about certificates? I'd love to chat with you about it.

Apple wants #SSL certificates to last only 47 days. Remember when they lasted 3 years? Then 2? Then 1? Now we're speed-running toward daily renewals. Your bash script from 2019 isn't ready for this certkit.io/blog/why-we-built-certkit

Hello World!