Live SSL certificate deployment next week. Real setup, not a polished demo. If something breaks, we fix it on air. June 16, 11am Central. With Richard Hicks. us02web.zoom.us/webinar/regi... #CertificateManagement #WindowsIT

PKI has a term for the leaf-to-root trust chain. It has no term for the series of certs you've been renewing for years. Certbot calls it a lineage. Nobody else picked it up. At 47-day lifetimes, naming this correctly starts to matter. www.certkit.io/blog/certifi... #PKI #TLS

Let's Encrypt drops cert lifetimes to 45 days by Feb 2028, a year early. CertKit now supports their TLS Server profile, so you can issue 45-day certs today and test your automation before the deadline. www.certkit.io/blog/managed... #LetsEncrypt #SSL

Managing SSL certs for clients? New: managed accounts. An MSP sets up the client's CertKit account, deploys certs and agents, then hands it over. Client owns it. You keep audited support access. www.certkit.io/blog/managed... #MSP #SSL

Apple's 398-day limit exempts private CAs. Most people stopped reading there. There's a second Apple requirement: all TLS certs, 825 days max. Safari silently rejects anything longer. No bypass, no details. www.certkit.io/blog/apple-d... #PrivatePKI #PKI

PSA: You don't need a private CA for internal SSL certificates. DNS-01 ACME challenges let you issue publicly trusted certs for servers that never touch the internet. No root cert distribution. No click-through warnings. www.certkit.io/blog/private... #PKI #SSL

When your auditor asks what happened to your certificates last Tuesday, you need an answer. CertKit now logs every action in your certificate lifecycle: issuances, renewals, revocations, deployments, agent approvals. With importance flags so you can find what matters. #CertificateManagement #PKI

F5 LTM. Palo Alto. Azure Key Vault. Exchange. We shipped a deployment scripting template library for all of them. Pick your target, configure your variables, and CertKit pushes the certificate to your infrastructure. www.certkit.io/blog/deploym... #CertificateManagement #PKI

50 SSL certificates managed manually today means roughly 50 renewals a year. Same team, same certs, in 2029: 400. The CA/Browser Forum's new lifetime schedule doesn't just change how often you renew. It changes the job. www.certkit.io/blog/shrinki... #PKI #SSL

Your VPN, RRAS, and IIS all need certificates. None of them can run ACME. Most teams patch this with scripts and hope. May 26, Richard Hicks and I are doing 30 minutes on what actually works. www.certkit.io/blog/webinar... #WindowsServer #SSL

Philip Greenspun's Tenth Rule: any complicated C program contains a bad implementation of half of Lisp. Certificate automation has the same problem. Todd named it. www.certkit.io/blog/todds-t... #CertificateManagement #SysAdmin

Managing SSL certs across dozens of servers? You shouldn't have to configure each one by hand. New in CertKit: copy and link agent configs across your fleet, search and filter your monitors, plus our first GDPR Data Processing Agreement. www.certkit.io/blog/shared-... #CertificateManagement #SSL

CertKit 1.9: push agent updates from the dashboard, no more logging into every server. Plus Google Trust Store as a second ACME issuer alongside Let's Encrypt. www.certkit.io/blog/agent-1.9 #CertificateManagement #SSL

One certificate management vendor used the word "trust" 17 times on their homepage. I still couldn't tell what they sell or what it costs. Apparently that's what the sales call is for. www.certkit.io/blog/perform... #PKI #cybersecurity

CertKit is out of beta. 600 signups. Certificates issuing, deploying, renewing in production. Features we never planned, built because users needed them. www.certkit.io/blog/out-of-... #PKI #CertificateManagement

Podcast with @toddhgardner.com about how web certificates work. In the next episode we'll talk about Certkit, a solution for SSL Certificate Lifecycle Management. nodogmapodcast.bryanhogan.net/180-todd-gar...

Are you ready to take a look at Richard's home lab? Living in a remote location with intermittent power and internet makes for a challenging lab environment! Check out the details on RunAs Radio at runasradio.com/Shows/Show/1...

Yes, we shipped a retro MS-DOS modal today. No, it's not an April Fools joke. Agent 1.8 also adds Windows Certificate Store support, Java Keystore format, and RDP auto-detection. www.certkit.io/blog/agent-1.8 #CertificateManagement #Windows

Let's Encrypt ran a mass revocation drill on 3 million production certificates in March 2026. They shortened ARI windows to simulate an emergency and watched who responded. Most ACME clients never noticed. www.certkit.io/blog/lets-en... #PKI #ACME

Oh look, a CA is "breaking the model" by offering unlimited managed certificates for ONLY $99,000. Meanwhile, you can do it for $99 with CertKit. www.prnewswire.com/news-release...

Your security policy says private keys can't leave the network. Certificate automation says they have to. We just fixed that. www.certkit.io/blog/certkit-keystore #PKI #CertificateManagement

Epic Games had a wildcard cert expire in 2021. Monitoring caught it in 12 minutes. Recovery took 5.5 hours and 25 people. The cert renewed fine. Distribution is where it fell apart. www.certkit.io/blog/certifi... #PKI #TLS

Mass certificate revocation isn’t a fire drill. It’s a 24-hour clock with thousands of certs on the line. ARI (RFC 9773) was built to handle exactly this. But it only works if your ACME client is actually listening. www.certkit.io/blog/ari-sol... #PKI #TLS

CertKit now supports ACME ARI and 6-day certificates. ARI means the CA tells us when to renew. We check it multiple times a day. The next mass revocation event will be boring for you. www.certkit.io/blog/acme-ar... #PKI #TLS

Your certificate renewed. The old one is still serving. Certbot solves "I forgot to renew." It doesn't tell you whether the new cert actually made it to your server. LinkedIn learned this the hard way in 2019. www.certkit.io/blog/how-to-... #PKI #TLS

Certificate management has always been a one-person job. Until something breaks, everyone ignores it. Until that one person leaves. CertKit now supports team access: roles, SAML SSO, MFA, and a weekly email digest. www.certkit.io/blog/user-ma... #CertKit #PKI

How does CertKit work? www.certkit.io/how-it-works

March 15 is the last day to issue a certificate with ~1 year of validity. After that, 200-day max. Then 100 in 2027. Then 47 in 2029. Renew now and you set your own automation schedule. Wait, and the CA/B Forum sets it for you. www.certkit.io/blog/last-ca... #PKI #CertificateManagement

CertKit Agent 1.6 is out: Microsoft RRAS support, deploy windows, and agent locking. Shorter cert lifetimes mean certificate automation has to act like real releases: issue, deploy, verify (and do it on your schedule). www.certkit.io/blog/agent-1.6 #CertificateAutomation #SysAdmin

Man-in-the-middle attacks are less than 4% It's mostly phishing proxies, not TLS interception. The attack every vendor warns about almost never happens. What actually compromises your connections? www.certkit.io/blog/man-in-...

Curious how CertKit works? I made a page for that. www.certkit.io/how-it-works

We bought certkit<.>dev and found someone else had a valid certificate for it. Tried to get it revoked: 6 emails, 24 hours, a support agent who called me "Tobb." 72 hours later, the cert is STILL trusted by every browser. www.certkit.io/blog/bygones... #WebPKI #CertificateManagement

Most “certificate automation” stops at issuance. That’s how you renew a cert but still serve the old one. CertKit Agent closes the loop: issue, deploy, verify. Write files to the right paths, set perms/ownership, run the restart. www.certkit.io/blog/certkit... #PKI #DevOps

You “automated certificates” with Certbot… and still got paged at 2am for an expired cert. Because you automated issuance, not certificate automation. The hard parts are deploy + verify. www.certkit.io/blog/issuanc... #ACME #CertificateManagement

CertBot assumes every server should manage its own certificates. That worked when you had three servers. But with web farms sharing wildcards, load balancers, mail servers, and VPN appliances, the distributed model collapses. www.certkit.io/blog/servers... #ACME #PKI

Let's Encrypt is moving to 45-day certificates by February 2028, a full year before the industry mandate. Authorization reuse drops to 7 hours. If your renewals aren't truly automated, you'll find out the hard way. www.certkit.io/blog/45-day-... #PKI #CertificateManagement

One API key with access to everything is fine until a contractor leaves or a key leaks. CertKit now supports multiple applications with scoped API keys. Your marketing site automation never sees production infrastructure. www.certkit.io/blog/applica... #PKI #CertificateManagement

Every service wants DNS validation for certificates. With 47-day lifetimes coming, that means dozens of systems holding credentials that can modify your entire zone. CNAME delegation is the fix: one record, no credentials exposed. www.certkit.io/blog/delegat... #PKI #ACME

We published the CertKit roadmap. Unlike most company roadmaps, it's not vague promises about AI-powered synergies. It's a list of features with vote buttons. Tell us what you actually need. www.certkit.io/blog/what-sh... #CertificateManagement #PKI

"Free certificates? For production?" Yes. Let's Encrypt uses the same encryption as that $500 EV cert. Chrome killed the green bar in 2018. Amazon, Netflix, and Walmart all use DV certs. Your objections are probably institutional habit, not evidence www.certkit.io/blog/should-... #PKI #WebSecurity

DNS-01 validation requires changing TXT records on every certificate renewal. With 47-day lifetimes coming, that's going to hurt. DNS-PERSIST-01 fixes it: validate once, get certs forever. www.certkit.io/blog/dns-per... #ACME #PKI

Do you still need wildcard certificates? Wildcard vs SAN assumes certificates are painful to manage. But once you've automated for 47-day lifetimes, issuing 50 certs takes the same effort as one. The question shifts to security, not convenience. www.certkit.io/blog/do-you-... #PKI #WebSecurity

CertKit now supports multi-domain certificates. Mix wildcards with specific hostnames on a single cert. Also shipped: actual ACME error messages instead of "something went wrong" and non-sequential IDs to stop enumeration attacks. www.certkit.io/blog/certkit... #SSL #PKI

In 2015, only 40% of websites used HTTPS. Today it's 95%. The ACME protocol made that happen by automating certificate issuance. But it didn't solve certificate operations. That's still your problem. www.certkit.io/blog/how-acm... #ACME #PKI

Just got our last certificate renewal email ever. All our products are now fully automated with CertKit. No more $144/year wildcard certs. No more renewal reminders. No more "your site will be vulnerable" scare tactics. Dogfooding feels so good. #SSL #PKI

The NSA recorded encrypted traffic for years, betting they'd eventually steal your private keys. With RSA key exchange, that worked. PFS broke their playbook. If you're still on TLS 1.2 without ECDHE, your traffic from 2019 might get decrypted tomorrow. www.certkit.io/blog/perfect... #TLS #PKI

How do you store 3 billion SSL certificates on a 2.5TB drive and query them in under 100ms? Clickhouse. Final part of our CT search series covers the database tricks that make it work. www.certkit.io/blog/searchi... #Clickhouse #PKI

Most JavaScript errors in your monitoring dashboard are garbage. Browser extensions, ad blockers, crawlers. Here's how I set up TrackJS to ignore the noise and only alert on real bugs that matter. www.youtube.com/watch?v=HBaZ... #javascript #errormonitoring

Eric Brandes just dropped Part 2 of our CT logs deep dive. Tiled logs process 100M+ records/day vs RFC 6962's measly millions. Google throttles you to death, Cloudflare's better, Let's Encrypt's tiled logs are best. www.certkit.io/blog/searchi... #PKI #CertificateTransparency

Certificate Transparency logs contain billions of certificates but searching them is painful. crt.sh is slow and often down. So we built our own free CT search tool that actually works. Part 1 of our series: www.certkit.io/blog/searchi... #CertificateTransparency #PKI