CertKit SSL Certificate Automation

How does CertKit work? www.certkit.io/how-it-works

Today and tomorrow, @toddhgardner.com is live at Internet2's TechEx in Minneapolis. If you're tired of renewing your SSL certificates, come say hello. He probably has stickers.

Starting tomorrow, Chrome shows NET::ERR_CERT_AUTHORITY_INVALID for InCommon SSL certificates on eMudhra's ECC root. 3,134 at 41 schools still chain to it. Skip eMudhra RSA, it's leaving too. Move once: www.certkit.io/blog/incommo... #PKI #SSL

Chrome stops trusting eMudhra's ECC root Tuesday. And eMudhra is leaving the TLS business, so InCommon certificates reissued on its RSA chain will have to move again. Move once. We can help this weekend. www.certkit.io/blog/emudhra... #PKI #SSL

Probably the hardest part of explaining the impact of the eMudhra certificate kerfuffle was working out exactly how many things an enterprise has to update when the chain of trust stops being trustworthy; second hardest was keeping up with eMudhra's explanations and in the end, they just gave up

turns out eMudhra - which just got out of the cert business altogether - isn't just a problem for Indian customers; the G3 root that signed the dodgy keys, that Firefox already distrusts, that Google will distrust on the 27th is what a bunch of US university certs chain up to

-----BEGIN EC PRIVATE KEY----- 4 -----END EC PRIVATE KEY----- That's they key behind Internet2's InCommon SSL. The root gets distrusted on Tuesday, and about 30K certificates need to get replaced. www.certkit.io/blog/emudhra... #PKI #SSL

We had 35 built-in SSL certificate deployment templates in July. It's 86 now! New: A10 Thunder, Cisco ISE, VMware Horizon, OpenVPN, WatchGuard, and IBM i. www.certkit.io/blog/certifi... #SSL #PKI

DigiCert, Sectigo, and Let's Encrypt have all changed their SSL certificate chains since 2025. An old chain file now passes in Chrome and fails in curl with "unable to get local issuer certificate." www.certkit.io/blog/unable-... #SSL #PKI

The NSA said stop using wildcard SSL certificates in 2021. We counted every active cert in the CT logs. 38% of domains run a wildcard. In .bank it's 79%. The most automated operators use them most. www.certkit.io/blog/wildcar... #SSL #PKI

The last publicly trusted client auth certificates from Let's Encrypt expired this week. If your mTLS setup is still running on one, it stopped renewing in July. There is nothing behind it. www.certkit.io/blog/public-...

Check any server's SSL certificate chain and post-quantum readiness with our free tools. No account needed. As of today, CertKit monitoring runs the same checks on your hosts, alongside expiry. www.certkit.io/blog/certifi... #TLS #PQC

Let's Encrypt promised DNS-PERSIST-01 by Q2. It's October. A 2024 ballot fight, a security hole found in April, and a September rewrite that broke every early record. Our guess is mid-2027. www.certkit.io/blog/whats-t... #LetsEncrypt #PKI

"Where is the SSL certificate for examplecom?" is now one search across every client you manage. New in CertKit: cross-collection search, a dashboard with a 90-day renewal timeline, and a read-only API for dashboards and invoices. www.certkit.io/blog/certkit...

SSTP, DirectAccess, RD Gateway, IIS, Exchange, ADFS. None run an ACME client, and every renewal touches a binding, a restart, or a reboot. Oct 6, Richard Hicks and I automate all of it. Bring the appliance nobody has given you a straight answer on: events.teams.microsoft.com/event/894fa7...

The certificate Common Name was deprecated in 2000. We checked 3 billion certs in CT logs and 96% still have one. Browsers ignore it. GlobalProtect, Cisco Umbrella, NetScaler, and Exchange don't. www.certkit.io/blog/does-a-... #PKI #SSL

Apple's draft policy for Merkle Tree Certificates caps validity at 7 days. Not a shorter X.509. A new post-quantum cert type, validated from periodic out-of-band client updates, so it only has to outlive the update cycle. 7 days costs nothing when nothing human renews it. #PKI

Some jerk got an SSL certificate for a subdomain we had forgotten about, and Google told us before our own CT log tool did. Now CertKit watches the log. You get an email when a certificate shows up for a name it has never seen on your domain. www.certkit.io/blog/ct-alerts

Your once-a-year SSL renewal becomes a five-times-a-year renewal on March 15, when public cert lifetimes drop from 200 days to 100. At 47 days, twelve. Oct 6, live with Richard Hicks on automating renewal for Windows servers, VPN, and appliances. Free: events.teams.microsoft.com/event/894fa7...

We're in the Japanese celebrity gossip site business now. A DNS record we forgot for ten years pointed at an IP we gave up. Some jerk got the IP, a Let's Encrypt cert, and a spam site The cert sat in our own CT tool the whole time. www.certkit.io/blog/danglin...

Cloud SSL certificate monitoring only sees what the internet sees. Your intranet pages expire too, but they don't warn anyone first. CertKit agents now monitor SSL certificates inside your network, and judge trust from the host's own trust store. www.certkit.io/blog/certifi... #PKI #sysadmin

I searched our own domain in the public certificate transparency logs. Three dev servers and four vendors, named. Nobody scanned us. We published it ourselves by getting SSL certificates. www.certkit.io/blog/somebod... #PKI

You didn't turn on the TLS key exchanges the IETF just banned. They shipped that way. nginx, Apache and Windows Server enable RSA key exchange by default. RFC 10015 says MUST NOT. www.certkit.io/blog/tls-1-2... #TLS

I spent months telling people not to run their own certificate authority. Today CertKit ships Private PKI. Running a CA is a job, so we took the job. Internal SSL certs that issue, renew, and get trusted automatically. www.certkit.io/blog/certkit... #PKI

Let's Encrypt issued its last client auth cert on July 8. They're 90-day certs, so the last expire in early October with no renewal behind them. If you run mTLS on public certs, that's the window. www.certkit.io/blog/public-...

A 47-day SSL certificate is not a shorter version of the same job. It is a different job. Once a year, a person can renew it. Eight times a year, they cannot. Issuance was solved. Distribution is the hard part. runasradio.com/Shows/Show/1... #SSL #SysAdmin

If you learned the TLS handshake from a textbook, half the steps no longer happen. No ClientKeyExchange. No 37 cipher suites. No secret on the wire. Attacks removed them one by one. www.certkit.io/blog/tls-han... #TLS #SysAdmin

CertKit now deploys SSL certificates to Microsoft Exchange, SQL Server, SSRS, and Citrix NetScaler. Exchange is auto-detected. Pick a template, pick a certificate, done. www.certkit.io/blog/easy-mo... #SSL #sysadmin

Why are SSL certificates dropping to 47 days? Because revocation is broken. OCSP fails open. Revocation lists go stale. A stolen certificate stays trusted too long. Short lifespans are the industry's workaround. runasradio.com/Shows/Show/1... #SSL #InfoSec

One SSL cert, three servers. Which one generates the private key? Generate-where-used breaks once a cert is shared. The key moves anyway. Design that, or it becomes scp in a cron job. www.certkit.io/blog/ssl-cer... #SSL #PKI

One SonicWall. The SSL certificate import API is barely documented and shifts between SonicOS versions. Now repeat for every appliance you run, up to 12x a year. Build it yourself and you maintain it forever. www.certkit.io/blog/automat... #SSL

The longest SSL certificate you can buy today is 200 days. By 2029 it will be 47. Revocation never worked, so the industry is killing long lifespans instead. @toddhgardner.com broke down the why on RunAs Radio. runasradio.com/Shows/Show/1... #SSL #PKI

Let's Encrypt is going post-quantum. I'm not worried about quantum computers. The real story in Merkle Tree Certificates: smaller handshakes, transparency built in, and even shorter cert lifetimes. www.certkit.io/blog/quantum... #SSL #PKI

The problem with SSL certificates is revocation mechanisms - they just don't work. So the industry has responded by shortening lifespans, ultimately to only 47 days. @ToddHGardner.com talks on RunAs Radio at runasradio.com/Shows/Show/1... about automating routine renewal of certificates!

Live SSL certificate deployment next week. Real setup, not a polished demo. If something breaks, we fix it on air. June 16, 11am Central. With Richard Hicks. us02web.zoom.us/webinar/regi... #CertificateManagement #WindowsIT

PKI has a term for the leaf-to-root trust chain. It has no term for the series of certs you've been renewing for years. Certbot calls it a lineage. Nobody else picked it up. At 47-day lifetimes, naming this correctly starts to matter. www.certkit.io/blog/certifi... #PKI #TLS

Let's Encrypt drops cert lifetimes to 45 days by Feb 2028, a year early. CertKit now supports their TLS Server profile, so you can issue 45-day certs today and test your automation before the deadline. www.certkit.io/blog/managed... #LetsEncrypt #SSL

Managing SSL certs for clients? New: managed accounts. An MSP sets up the client's CertKit account, deploys certs and agents, then hands it over. Client owns it. You keep audited support access. www.certkit.io/blog/managed... #MSP #SSL

Apple's 398-day limit exempts private CAs. Most people stopped reading there. There's a second Apple requirement: all TLS certs, 825 days max. Safari silently rejects anything longer. No bypass, no details. www.certkit.io/blog/apple-d... #PrivatePKI #PKI

PSA: You don't need a private CA for internal SSL certificates. DNS-01 ACME challenges let you issue publicly trusted certs for servers that never touch the internet. No root cert distribution. No click-through warnings. www.certkit.io/blog/private... #PKI #SSL

When your auditor asks what happened to your certificates last Tuesday, you need an answer. CertKit now logs every action in your certificate lifecycle: issuances, renewals, revocations, deployments, agent approvals. With importance flags so you can find what matters. #CertificateManagement #PKI

F5 LTM. Palo Alto. Azure Key Vault. Exchange. We shipped a deployment scripting template library for all of them. Pick your target, configure your variables, and CertKit pushes the certificate to your infrastructure. www.certkit.io/blog/deploym... #CertificateManagement #PKI

50 SSL certificates managed manually today means roughly 50 renewals a year. Same team, same certs, in 2029: 400. The CA/Browser Forum's new lifetime schedule doesn't just change how often you renew. It changes the job. www.certkit.io/blog/shrinki... #PKI #SSL

Your VPN, RRAS, and IIS all need certificates. None of them can run ACME. Most teams patch this with scripts and hope. May 26, Richard Hicks and I are doing 30 minutes on what actually works. www.certkit.io/blog/webinar... #WindowsServer #SSL

Philip Greenspun's Tenth Rule: any complicated C program contains a bad implementation of half of Lisp. Certificate automation has the same problem. Todd named it. www.certkit.io/blog/todds-t... #CertificateManagement #SysAdmin

Managing SSL certs across dozens of servers? You shouldn't have to configure each one by hand. New in CertKit: copy and link agent configs across your fleet, search and filter your monitors, plus our first GDPR Data Processing Agreement. www.certkit.io/blog/shared-... #CertificateManagement #SSL

CertKit 1.9: push agent updates from the dashboard, no more logging into every server. Plus Google Trust Store as a second ACME issuer alongside Let's Encrypt. www.certkit.io/blog/agent-1.9 #CertificateManagement #SSL

One certificate management vendor used the word "trust" 17 times on their homepage. I still couldn't tell what they sell or what it costs. Apparently that's what the sales call is for. www.certkit.io/blog/perform... #PKI #cybersecurity

CertKit is out of beta. 600 signups. Certificates issuing, deploying, renewing in production. Features we never planned, built because users needed them. www.certkit.io/blog/out-of-... #PKI #CertificateManagement

Are you ready to take a look at Richard's home lab? Living in a remote location with intermittent power and internet makes for a challenging lab environment! Check out the details on RunAs Radio at runasradio.com/Shows/Show/1...