We sell CT log search, and Google told us about our own subdomain takeover. Now we're in Japanese celebrity gossip. Wrote it up, including the alert we hadn't shipped yet.

CertKit SSL Certificate Automation@certkit.io · last wk.

We're in the Japanese celebrity gossip site business now. A DNS record we forgot for ten years pointed at an IP we gave up. Some jerk got the IP, a Let's Encrypt cert, and a spam site The cert sat in our own CT tool the whole time. www.certkit.io/blog/danglin...

I have spent ten years building tools because certificates kept breaking things at the worst possible time. Talking through the 47-day shift on RunAs Radio reminded me how few people see it coming.

CertKit SSL Certificate Automation@certkit.io · 3mo ago

The longest SSL certificate you can buy today is 200 days. By 2029 it will be 47. Revocation never worked, so the industry is killing long lifespans instead. @toddhgardner.com broke down the why on RunAs Radio. runasradio.com/Shows/Show/1... #SSL #PKI

I hate demo environments. They answer "does this work ideally" which is not your question. June 16 I'm doing the real thing live with Richard Hicks. Come watch.

CertKit SSL Certificate Automation@certkit.io · 4mo ago

Live SSL certificate deployment next week. Real setup, not a polished demo. If something breaks, we fix it on air. June 16, 11am Central. With Richard Hicks. us02web.zoom.us/webinar/regi... #CertificateManagement #WindowsIT

Hard to fake. An expert who's been doing web performance for a decade, switching tools and explaining exactly why. That's the kind of proof that actually means something.

Request Metrics@requestmetrics.com · 4mo ago

Web performance agencies bill by the hour. Every hour spent hunting a root cause is one not spent fixing. @eroan.bsky.social found a CLS cause in 10 minutes on his first day with Request Metrics. Pages, element, fix. #WebPerformance #CLS

One of the first things a security audit asks for is an activity log. CertKit now has one. Every certificate action, logged, attributed, and flagged by importance.

CertKit SSL Certificate Automation@certkit.io · 4mo ago

When your auditor asks what happened to your certificates last Tuesday, you need an answer. CertKit now logs every action in your certificate lifecycle: issuances, renewals, revocations, deployments, agent approvals. With importance flags so you can find what matters. #CertificateManagement #PKI

Web performance agencies bill by the hour. Every hour spent hunting a root cause is one not spent fixing. @eroan.bsky.social found a CLS cause in 10 minutes on his first day with Request Metrics. Pages, element, fix. #WebPerformance #CLS

Every infra team has a folder called "cert scripts" with PowerShell nobody remembers writing. We built the thing that replaces it.

CertKit SSL Certificate Automation@certkit.io · 5mo ago

F5 LTM. Palo Alto. Azure Key Vault. Exchange. We shipped a deployment scripting template library for all of them. Pick your target, configure your variables, and CertKit pushes the certificate to your infrastructure. www.certkit.io/blog/deploym... #CertificateManagement #PKI

50 SSL certificates managed manually means 50 renewals a year today. Same team, same certs, in 2029: 400. I did the math in this post.

CertKit SSL Certificate Automation@certkit.io · 5mo ago

50 SSL certificates managed manually today means roughly 50 renewals a year. Same team, same certs, in 2029: 400. The CA/Browser Forum's new lifetime schedule doesn't just change how often you renew. It changes the job. www.certkit.io/blog/shrinki... #PKI #SSL

Named a rule after myself. It felt right. Anyone who's been doing cert automation for a few years has accidentally built the thing I'm describing.

CertKit SSL Certificate Automation@certkit.io · 5mo ago

Philip Greenspun's Tenth Rule: any complicated C program contains a bad implementation of half of Lisp. Certificate automation has the same problem. Todd named it. www.certkit.io/blog/todds-t... #CertificateManagement #SysAdmin

Shipped remote agent updates and Google Trust Store support in CertKit this week. Two features I've been wanting to get out the door for a while.

CertKit SSL Certificate Automation@certkit.io · 6mo ago

CertKit 1.9: push agent updates from the dashboard, no more logging into every server. Plus Google Trust Store as a second ACME issuer alongside Let's Encrypt. www.certkit.io/blog/agent-1.9 #CertificateManagement #SSL

Most engineers undervalue their time. You have more important work to do than re-inventing the wheel.

Dylan Beattie@dylanbeatt.ie · 6mo ago

"That's quite expensive. We'll just build our own." "Your library doesn't do what we need. Fix it now. For free." "Why do you want budget to pay for free software?" "You said this was free! How dare you charge money for the latest version!" Sound familiar? Help us fix it: usewhatworks.org

I spent a week on competitor websites before we launched. I couldn't figure out what a single one of them does. The security vendors selling you on "trust" are remarkably opaque.

CertKit SSL Certificate Automation@certkit.io · 6mo ago

One certificate management vendor used the word "trust" 17 times on their homepage. I still couldn't tell what they sell or what it costs. Apparently that's what the sales call is for. www.certkit.io/blog/perform... #PKI #cybersecurity

CertKit is out of beta today. After a year, 600+ beta users, and more Windows edge cases than I care to admit, it's a real product. www.toddhgardner.com/blog/certkit...

CertKit is Out of Beta

Why I built a certificate management platform, what's wrong with the way we handle certs today, and why CertKit exists as a commercial product now.

toddhgardner.com

The Windows Certificate Store integration in Agent 1.8 is going to eliminate a lot of the wrapper scripts I see. www.certkit.io/blog/agent-1.8

CertKit Agent 1.8: Windows RDP, Windows Certificate Store, and Java keystores

Agent 1.8 closes the last gaps in Windows and Java certificate deployment. Write directly into the Windows Certificate Store, auto-detect Remote Desktop and Remote Gateway, drop JKS files for legacy J...

certkit.io

CertKit SSL Certificate Automation@certkit.io · 6mo ago

Yes, we shipped a retro MS-DOS modal today. No, it's not an April Fools joke. Agent 1.8 also adds Windows Certificate Store support, Java Keystore format, and RDP auto-detection. www.certkit.io/blog/agent-1.8 #CertificateManagement #Windows

Let's Encrypt quietly ran a mass revocation drill last week. 3 million real certificates. Most automation never noticed. That's the problem.

CertKit SSL Certificate Automation@certkit.io · 6mo ago

Let's Encrypt ran a mass revocation drill on 3 million production certificates in March 2026. They shortened ARI windows to simulate an emergency and watched who responded. Most ACME clients never noticed. www.certkit.io/blog/lets-en... #PKI #ACME

For the orgs that asked: yes, you can now use CertKit without sending us your private keys. The keystore runs on your infrastructure. Keys never leave.

CertKit SSL Certificate Automation@certkit.io · 6mo ago

Your security policy says private keys can't leave the network. Certificate automation says they have to. We just fixed that. www.certkit.io/blog/certkit-keystore #PKI #CertificateManagement

The forums answer for deploying certs to multiple servers is always "just write a script." That script quietly becomes the most critical unmonitored piece of infrastructure you own.

CertKit SSL Certificate Automation@certkit.io · 6mo ago

Epic Games had a wildcard cert expire in 2021. Monitoring caught it in 12 minutes. Recovery took 5.5 hours and 25 people. The cert renewed fine. Distribution is where it fell apart. www.certkit.io/blog/certifi... #PKI #TLS

ARI is the protocol that makes mass revocation survivable. Most ACME clients aren’t using it right. Cron jobs don’t cut it when the CA needs a response in 6 hours.

CertKit SSL Certificate Automation@certkit.io · 7mo ago

Mass certificate revocation isn’t a fire drill. It’s a 24-hour clock with thousands of certs on the line. ARI (RFC 9773) was built to handle exactly this. But it only works if your ACME client is actually listening. www.certkit.io/blog/ari-sol... #PKI #TLS

We added ARI so when a CA has to pull 83,000 certs overnight (hi DigiCert), it's just a quiet Tuesday. Certificate emergencies are getting boring.

CertKit SSL Certificate Automation@certkit.io · 7mo ago

CertKit now supports ACME ARI and 6-day certificates. ARI means the CA tells us when to renew. We check it multiple times a day. The next mass revocation event will be boring for you. www.certkit.io/blog/acme-ar... #PKI #TLS

Renewed doesn't mean deployed. Certificate automation has a verification gap that almost nobody closes, and the consequences are getting worse as cert lifetimes shrink.

CertKit SSL Certificate Automation@certkit.io · 7mo ago

Your certificate renewed. The old one is still serving. Certbot solves "I forgot to renew." It doesn't tell you whether the new cert actually made it to your server. LinkedIn learned this the hard way in 2019. www.certkit.io/blog/how-to-... #PKI #TLS

Certificate expiration is a team problem that keeps getting assigned to one person. We just shipped the tools to fix that.

CertKit SSL Certificate Automation@certkit.io · 7mo ago

Certificate management has always been a one-person job. Until something breaks, everyone ignores it. Until that one person leaves. CertKit now supports team access: roles, SAML SSO, MFA, and a weekly email digest. www.certkit.io/blog/user-ma... #CertKit #PKI

GitHub felt more reliable when it was a pile of ruby on rails and a fistful of dreams.

Get your last 1 year SSL certificates now, while the gettin is good.

CertKit SSL Certificate Automation@certkit.io · 7mo ago

March 15 is the last day to issue a certificate with ~1 year of validity. After that, 200-day max. Then 100 in 2027. Then 47 in 2029. Renew now and you set your own automation schedule. Wait, and the CA/B Forum sets it for you. www.certkit.io/blog/last-ca... #PKI #CertificateManagement

New post. AI code looks great in the diff and breaks on the first edge case. The instinct is to reverse-engineer the author's assumptions, but that approach is slow and usually wrong.

TrackJS@trackjs.com · 7mo ago

Whatever autocomplete casino your team is using this week, the bug report still lands on your desk like you wrote it yourself. Here's how to debug code you didn't write (and didn't break). trackjs.com/blog/how-to-debug-code-you-didnt-write/ #JavaScript #debugging

If you’re still treating cert renewals like a calendar reminder, March is gonna be spicy.

CertKit SSL Certificate Automation@certkit.io · 7mo ago

CertKit Agent 1.6 is out: Microsoft RRAS support, deploy windows, and agent locking. Shorter cert lifetimes mean certificate automation has to act like real releases: issue, deploy, verify (and do it on your schedule). www.certkit.io/blog/agent-1.6 #CertificateAutomation #SysAdmin

This is one of my favorite cybersecurity posts we've done. I dug into the data on MITM attacks and the threat model most of us worry about is basically fiction.

CertKit SSL Certificate Automation@certkit.io · 7mo ago

Man-in-the-middle attacks are less than 4% It's mostly phishing proxies, not TLS interception. The attack every vendor warns about almost never happens. What actually compromises your connections? www.certkit.io/blog/man-in-...

The ICE surge in Minnesota cost $280M, to detain 4k people of whom only 30 were accused of violent crimes. $9 million per capture of the "worst of the worst". Plus two citizens murdered. ~ Veterans for Peace

I keep seeing AI-generated diffs that are plausible and wrong in the most annoying ways: missing guards, cargo-cult hooks, swallowed promises. If your review is vibes, you’re gambling. Production has receipts.

TrackJS@trackjs.com · 7mo ago

Vibe coding ships fast. Then prod finds the one weird browser + slow network combo and your “looks fine” code catches fire. You can’t code review vibes, you need production visibility. trackjs.com/blog/who-wat... #JavaScript #WebDev