I hate demo environments. They answer "does this work ideally" which is not your question. June 16 I'm doing the real thing live with Richard Hicks. Come watch.

Hard to fake. An expert who's been doing web performance for a decade, switching tools and explaining exactly why. That's the kind of proof that actually means something.

One of the first things a security audit asks for is an activity log. CertKit now has one. Every certificate action, logged, attributed, and flagged by importance.

Web performance agencies bill by the hour. Every hour spent hunting a root cause is one not spent fixing. @eroan.bsky.social found a CLS cause in 10 minutes on his first day with Request Metrics. Pages, element, fix. #WebPerformance #CLS

Every infra team has a folder called "cert scripts" with PowerShell nobody remembers writing. We built the thing that replaces it.

50 SSL certificates managed manually means 50 renewals a year today. Same team, same certs, in 2029: 400. I did the math in this post.

Named a rule after myself. It felt right. Anyone who's been doing cert automation for a few years has accidentally built the thing I'm describing.

Shipped remote agent updates and Google Trust Store support in CertKit this week. Two features I've been wanting to get out the door for a while.

Most engineers undervalue their time. You have more important work to do than re-inventing the wheel.

I spent a week on competitor websites before we launched. I couldn't figure out what a single one of them does. The security vendors selling you on "trust" are remarkably opaque.

CertKit is out of beta today. After a year, 600+ beta users, and more Windows edge cases than I care to admit, it's a real product. www.toddhgardner.com/blog/certkit...

The Windows Certificate Store integration in Agent 1.8 is going to eliminate a lot of the wrapper scripts I see. www.certkit.io/blog/agent-1.8

Let's Encrypt quietly ran a mass revocation drill last week. 3 million real certificates. Most automation never noticed. That's the problem.

For the orgs that asked: yes, you can now use CertKit without sending us your private keys. The keystore runs on your infrastructure. Keys never leave.

The forums answer for deploying certs to multiple servers is always "just write a script." That script quietly becomes the most critical unmonitored piece of infrastructure you own.

ARI is the protocol that makes mass revocation survivable. Most ACME clients aren’t using it right. Cron jobs don’t cut it when the CA needs a response in 6 hours.

We added ARI so when a CA has to pull 83,000 certs overnight (hi DigiCert), it's just a quiet Tuesday. Certificate emergencies are getting boring.

Renewed doesn't mean deployed. Certificate automation has a verification gap that almost nobody closes, and the consequences are getting worse as cert lifetimes shrink.

Certificate expiration is a team problem that keeps getting assigned to one person. We just shipped the tools to fix that.

GitHub felt more reliable when it was a pile of ruby on rails and a fistful of dreams.

Get your last 1 year SSL certificates now, while the gettin is good.

New post. AI code looks great in the diff and breaks on the first edge case. The instinct is to reverse-engineer the author's assumptions, but that approach is slow and usually wrong.

If you’re still treating cert renewals like a calendar reminder, March is gonna be spicy.

This is one of my favorite cybersecurity posts we've done. I dug into the data on MITM attacks and the threat model most of us worry about is basically fiction.

The ICE surge in Minnesota cost $280M, to detain 4k people of whom only 30 were accused of violent crimes. $9 million per capture of the "worst of the worst". Plus two citizens murdered. ~ Veterans for Peace

I keep seeing AI-generated diffs that are plausible and wrong in the most annoying ways: missing guards, cargo-cult hooks, swallowed promises. If your review is vibes, you’re gambling. Production has receipts.

My first published software was part of a level pack for Duke Nukem.

We wanted to understand how rugged English-Scots-Irish culture has shaped America. So we talked to three white South African billionaires at a sex party in the Bahamas.

BygoneSSL isn't theoretical. We found a valid certificate on our own domain, issued to someone we've never met. Getting it revoked was an experience.

“Go to sleep with itchy butt, wake up with stinky finger” This game was such a gem for teenage todd 🤣

It’s weird to see people who aren’t from Minnesota talking about Minnesota.

Jikipedia turns Epstein’s emails into an encyclopedia of the his powerful friends

📢 Attention Software Developers! The #EarlyBird ticket offer for NDC Toronto closes this Monday, Feb 16th 🇨🇦 Join @stevesanderson.bsky.social and 55 other industry experts for 4 days of learning, networking, and fun! Secure your spot 👉 ndctoronto.com

Your Speed Index is bad but the page looks fine? Lighthouse records a video of your page loading and scores how fast the viewport fills in. Not just the first pixel, the whole visual experience. requestmetrics.com/web-performa... #WebPerf

“Certificate automation” that ends at issuance is wishful thinking. CertKit Agent is issue, deploy, verify, plus the boring stuff like perms and restarts.

I want to have a test Windows Server/IIS Server to test integrations with @certkit.io. It doesn't need to save any state. Microsoft friends, what's the best way to do this?

I made a little software platform for people to keep track of what's in their home bar. hmu if you wanna try it out yourself. booz.bar/about/

Certbot exiting 0 is not success. If you’re not deploying everywhere and verifying a real TLS handshake, you didn’t automate anything.

Lighthouse’s “First Meaningful Paint” sounds important. It isn’t. It’s deprecated, misleading, and still confusing people into fixing the wrong stuff. Here’s what FMP actually was, why Google killed it, and what to watch instead. requestmetrics.com/web-performa... #webperf #corewebvitals

I’ve debugged this exact Safari error way too many times. It usually shows up after someone copies WKWebView code into a regular browser context and everything explodes. If this feels familiar, you’re not alone.

We spent years with rsync cron jobs and Ansible playbooks distributing certificates. Turns out we'd poorly reinvented centralized certificate management. Wrote about why CertBot's model breaks.

Unexpected end of input errors in production? Your code is fine. The server returned nothing when your JSON parser expected data. Empty responses, HTML error pages, truncated network calls. trackjs.com/javascript-e... #JavaScript #WebDev

Let's Encrypt is going to 45-day certificates by February 2028. Authorization reuse drops to 7 hours. This will expose every shop that thought they had automation but really just had a cron job.

The Brave Little Guillotine (2025)

Your hero image takes 5 seconds to show up? Users already hit the back button. That's Largest Contentful Paint killing your conversions and search rankings. Here's how to fix it: requestmetrics.com/web-performa... #WebPerf #CoreWebVitals

Firefox throws "undefined has no properties" when you destructure null or undefined. It's the least helpful error message of all browsers for this problem. What's happening and how to fix it: trackjs.com/javascript-e... #JavaScript #Firefox

New CertKit feature: applications with scoped API keys. Split your certificates by product or environment. If a key leaks, you're not revoking access to everything.