Tessera
Folgen

CertKit SSL Certificate Automation

@certkit.io

Automated SSL certificate management for IT teams who have better things to do. No scripts, no cron jobs. Free 90-day trial to start renewing your certificates. Learn more at https://www.certkit.io/

80 Posts26 Follower25 Folgt
CertKit SSL Certificate Automation@certkit.io · 6d ago

I spent months telling people not to run their own certificate authority. Today CertKit ships Private PKI. Running a CA is a job, so we took the job. Internal SSL certs that issue, renew, and get trusted automatically. www.certkit.io/blog/certkit... #PKI

CertKit Private PKI: A private certificate authority without running one yourself

I spent months telling you not to run your own certificate authority. Today CertKit ships Private PKI. Both things are true, because the job was the problem, and we took the job.

certkit.io

CertKit SSL Certificate Automation@certkit.io · last wk.

Let's Encrypt issued its last client auth cert on July 8. They're 90-day certs, so the last expire in early October with no renewal behind them. If you run mTLS on public certs, that's the window. www.certkit.io/blog/public-...

Public mTLS client-auth certificates stop renewing in October

Chrome's root program is pulling mTLS client authentication out of the public web PKI. Let's Encrypt got there first, and the last client certificates they issued expire in early October.

certkit.io

CertKit SSL Certificate Automation@certkit.io · 3w ago

A 47-day SSL certificate is not a shorter version of the same job. It is a different job. Once a year, a person can renew it. Eight times a year, they cannot. Issuance was solved. Distribution is the hard part. runasradio.com/Shows/Show/1... #SSL #SysAdmin

47 Day Certificates with Todd Gardner

The 47-day certificate is coming! While at NDC in Toronto, Richard received an update from Todd Gardner about his show last year: certificate authorities are moving toward SSL certificates that last o...

runasradio.com

CertKit SSL Certificate Automation@certkit.io · 3w ago

If you learned the TLS handshake from a textbook, half the steps no longer happen. No ClientKeyExchange. No 37 cipher suites. No secret on the wire. Attacks removed them one by one. www.certkit.io/blog/tls-han... #TLS #SysAdmin

How the TLS handshake works, and why half of it is gone

Every HTTPS connection starts with a TLS handshake. Most explanations walk the steps without telling you why they exist, or why half the steps you learned no longer happen. The modern handshake is sho...

certkit.io

CertKit SSL Certificate Automation@certkit.io · 4w ago

CertKit now deploys SSL certificates to Microsoft Exchange, SQL Server, SSRS, and Citrix NetScaler. Exchange is auto-detected. Pick a template, pick a certificate, done. www.certkit.io/blog/easy-mo... #SSL #sysadmin

Certificate deployments just got an easy mode

The old deployment flow expected you to know certificate formats, store locations, and your way around a script editor. The new one asks for a template, a name, and a certificate. That's it.

certkit.io

CertKit SSL Certificate Automation@certkit.io · 4w ago

Why are SSL certificates dropping to 47 days? Because revocation is broken. OCSP fails open. Revocation lists go stale. A stolen certificate stays trusted too long. Short lifespans are the industry's workaround. runasradio.com/Shows/Show/1... #SSL #InfoSec

47 Day Certificates with Todd Gardner

The 47-day certificate is coming! While at NDC in Toronto, Richard received an update from Todd Gardner about his show last year: certificate authorities are moving toward SSL certificates that last o...

runasradio.com

CertKit SSL Certificate Automation@certkit.io · last mo.

One SSL cert, three servers. Which one generates the private key? Generate-where-used breaks once a cert is shared. The key moves anyway. Design that, or it becomes scp in a cron job. www.certkit.io/blog/ssl-cer... #SSL #PKI

One SSL certificate on multiple servers

Generating the private key on the server it protects is the textbook answer. Then someone asks for a wildcard, or a second server, and the textbook doesn't have a chapter for that.

certkit.io

CertKit SSL Certificate Automation@certkit.io · last mo.

One SonicWall. The SSL certificate import API is barely documented and shifts between SonicOS versions. Now repeat for every appliance you run, up to 12x a year. Build it yourself and you maintain it forever. www.certkit.io/blog/automat... #SSL

Automating SonicWall Certificate Deployment with the SonicOS API

Certificate lifetimes are shrinking to 47 days. Manually updating SSL certificates through the SonicWall Administration UI is no longer an option. We automate the process, but SonicOS doesn't make it ...

certkit.io

CertKit SSL Certificate Automation@certkit.io · last mo.

The longest SSL certificate you can buy today is 200 days. By 2029 it will be 47. Revocation never worked, so the industry is killing long lifespans instead. @toddhgardner.com broke down the why on RunAs Radio. runasradio.com/Shows/Show/1... #SSL #PKI

47 Day Certificates with Todd Gardner

The 47-day certificate is coming! While at NDC in Toronto, Richard received an update from Todd Gardner about his show last year: certificate authorities are moving toward SSL certificates that last o...

runasradio.com

CertKit SSL Certificate Automation@certkit.io · last mo.

Let's Encrypt is going post-quantum. I'm not worried about quantum computers. The real story in Merkle Tree Certificates: smaller handshakes, transparency built in, and even shorter cert lifetimes. www.certkit.io/blog/quantum... #SSL #PKI

Quantum is the least interesting part of quantum certificates

Let's Encrypt just committed to Merkle Tree Certificates for a post-quantum web. I don't think quantum computers are close. The plan is still worth your attention, just not for the reason the headline...

certkit.io

CertKit SSL Certificate Automation@certkit.io · 2mo ago

Live SSL certificate deployment next week. Real setup, not a polished demo. If something breaks, we fix it on air. June 16, 11am Central. With Richard Hicks. us02web.zoom.us/webinar/regi... #CertificateManagement #WindowsIT

Welcome! You are invited to join a webinar: Certificate Automation in Practice: A Technical Deep Dive for Windows IT. After registering, you will receive a confirmation email about joining the webinar...

with Richard Hicks and Todd Gardner June 16 | 11:00am Central | 60 minutes | Free The first question most Windows IT teams have after deciding to automate certificate management isn't "should we do t...

us02web.zoom.us

CertKit SSL Certificate Automation@certkit.io · 2mo ago

PKI has a term for the leaf-to-root trust chain. It has no term for the series of certs you've been renewing for years. Certbot calls it a lineage. Nobody else picked it up. At 47-day lifetimes, naming this correctly starts to matter. www.certkit.io/blog/certifi... #PKI #TLS

Certificate lineage: the concept your tools already use but nobody named

PKI has precise terminology for almost everything. The one thing it never named is the series of certificates you've been renewing for years. Here's what it is, why it matters now, and why your tools ...

certkit.io

CertKit SSL Certificate Automation@certkit.io · 2mo ago

Let's Encrypt drops cert lifetimes to 45 days by Feb 2028, a year early. CertKit now supports their TLS Server profile, so you can issue 45-day certs today and test your automation before the deadline. www.certkit.io/blog/managed... #LetsEncrypt #SSL

Managed accounts for MSPs, plus 45-day certificates you can use today

MSPs can now stand up fully-managed CertKit accounts for their clients, deploy certificates and agents, then hand over the keys. We also added support for Let's Encrypt's TLS Server profile, so you ca...

certkit.io

CertKit SSL Certificate Automation@certkit.io · 2mo ago

Managing SSL certs for clients? New: managed accounts. An MSP sets up the client's CertKit account, deploys certs and agents, then hands it over. Client owns it. You keep audited support access. www.certkit.io/blog/managed... #MSP #SSL

Managed accounts for MSPs, plus 45-day certificates you can use today

MSPs can now stand up fully-managed CertKit accounts for their clients, deploy certificates and agents, then hand over the keys. We also added support for Let's Encrypt's TLS Server profile, so you ca...

certkit.io

CertKit SSL Certificate Automation@certkit.io · 2mo ago

Apple's 398-day limit exempts private CAs. Most people stopped reading there. There's a second Apple requirement: all TLS certs, 825 days max. Safari silently rejects anything longer. No bypass, no details. www.certkit.io/blog/apple-d... #PrivatePKI #PKI

Apple doesn't care who signed your certificate

Running a private CA to escape the public cert treadmill makes sense. Apple still enforces an 825-day validity limit in Safari on every TLS certificate, no matter who issued it.

certkit.io

CertKit SSL Certificate Automation@certkit.io · 2mo ago

PSA: You don't need a private CA for internal SSL certificates. DNS-01 ACME challenges let you issue publicly trusted certs for servers that never touch the internet. No root cert distribution. No click-through warnings. www.certkit.io/blog/private... #PKI #SSL

You probably don't need private PKI for internal infrastructure

Most teams assume internal infrastructure needs a private CA. It doesn't - and skipping it saves you from a maintenance burden that never fully works anyway.

certkit.io

CertKit SSL Certificate Automation@certkit.io · 3mo ago

F5 LTM. Palo Alto. Azure Key Vault. Exchange. We shipped a deployment scripting template library for all of them. Pick your target, configure your variables, and CertKit pushes the certificate to your infrastructure. www.certkit.io/blog/deploym... #CertificateManagement #PKI

Remote deployment scripting

CertKit now ships centrally managed deployment scripts that push certificates directly to appliances, cloud platforms, and custom infrastructure, with a template library and encrypted variable storage...

certkit.io

CertKit SSL Certificate Automation@certkit.io · 3mo ago

50 SSL certificates managed manually today means roughly 50 renewals a year. Same team, same certs, in 2029: 400. The CA/Browser Forum's new lifetime schedule doesn't just change how often you renew. It changes the job. www.certkit.io/blog/shrinki... #PKI #SSL

Certificate lifetimes are shrinking.

Certificate validity is dropping from 398 days to 47 days by 2029. Here is the canonical schedule, what's driving it, and what it does to your renewal workload.

certkit.io

CertKit SSL Certificate Automation@certkit.io · 3mo ago

Your VPN, RRAS, and IIS all need certificates. None of them can run ACME. Most teams patch this with scripts and hope. May 26, Richard Hicks and I are doing 30 minutes on what actually works. www.certkit.io/blog/webinar... #WindowsServer #SSL

Live Webinar: certificate automation for Windows infrastructure

On May 26, I'm doing a 30-minute live session with Richard Hicks on what actually works for SSL certificate automation in Windows environments. VPNs, IIS, RRAS, vendor appliances, the endpoints that c...

certkit.io

CertKit SSL Certificate Automation@certkit.io · 3mo ago

Philip Greenspun's Tenth Rule: any complicated C program contains a bad implementation of half of Lisp. Certificate automation has the same problem. Todd named it. www.certkit.io/blog/todds-t... #CertificateManagement #SysAdmin

Todd's Tenth Rule of certificate automation

Any sufficiently complicated SSL certificate renewal system contains an ad hoc, informally-specified, bug-ridden, slow implementation of half a certificate lifecycle manager. I'm taking credit for thi...

certkit.io

CertKit SSL Certificate Automation@certkit.io · 4mo ago

Managing SSL certs across dozens of servers? You shouldn't have to configure each one by hand. New in CertKit: copy and link agent configs across your fleet, search and filter your monitors, plus our first GDPR Data Processing Agreement. www.certkit.io/blog/shared-... #CertificateManagement #SSL

Shared agent configs, monitor search, and a GDPR policy

Copy and share agent configurations across your fleet, search and sort your monitored domains, and our first official Data Processing Agreement for GDPR compliance.

certkit.io

CertKit SSL Certificate Automation@certkit.io · 4mo ago

CertKit 1.9: push agent updates from the dashboard, no more logging into every server. Plus Google Trust Store as a second ACME issuer alongside Let's Encrypt. www.certkit.io/blog/agent-1.9 #CertificateManagement #SSL

Remote Agent Updates and Google Trust Store

Agent 1.9 adds remote push updates so you can upgrade your entire fleet from the dashboard, plus first-class support for Google Trust Store as an ACME certificate issuer alongside Let's Encrypt.

certkit.io

CertKit SSL Certificate Automation@certkit.io · 4mo ago

One certificate management vendor used the word "trust" 17 times on their homepage. I still couldn't tell what they sell or what it costs. Apparently that's what the sales call is for. www.certkit.io/blog/perform... #PKI #cybersecurity

Performative Trust Maximalism

Certificate management vendors use the word "trust" so often it stops meaning anything. They also won't tell you what the product does, or what it costs, without a sales call first. These are, I shoul...

certkit.io

CertKit SSL Certificate Automation@certkit.io · 4mo ago

Let's Encrypt ran a mass revocation drill on 3 million production certificates in March 2026. They shortened ARI windows to simulate an emergency and watched who responded. Most ACME clients never noticed. www.certkit.io/blog/lets-en... #PKI #ACME

Let's Encrypt simulated revoking 3 million certificates. Most ACME clients didn't notice.

Let's Encrypt ran their first annual mass revocation drill, shortening ARI renewal windows across 3 million production certificates. Here's what happened.

certkit.io