Todd H. Gardner

16 Nov 2024

I couldn’t find one, so I made an #MNTech Starter Pack. I probably missed people, lmk. go.bsky.app/GuXLfRs

Hey #TechEx26

Today and tomorrow, @toddhgardner.com is live at Internet2's TechEx in Minneapolis. If you're tired of renewing your SSL certificates, come say hello. He probably has stickers.

certkit.ioThe NSA said wildcard certificates are bad. Everyone uses them anyway.38% of domains run a wildcard certificate, including most of .bank and .edu. Here's why the common security advice wasn't followed.

In December I said automation would kill wildcard certs. We counted. The most automated operators use them most. I was wrong. www.certkit.io/blog/wildcar...

preload.agencewebperformance.frPreload, the changing web, prioritized for youThe weekly newsletter for the people who make the web, written by Eroan Boyer, founder of Agence Web Performance. Every item with its primary source and the step to take.

If you're making the web fast, this will help. @eroan.bsky.social has kicked off a newsletter resource to stay up to date on everything happening with web performance. preload.agencewebperformance.fr/en/

22 Sept

We sell CT log search, and Google told us about our own subdomain takeover. Now we're in Japanese celebrity gossip. Wrote it up, including the alert we hadn't shipped yet.

certkit.ioHow a ten-year-old dangling DNS record handed one of our subdomains to spammersWe forgot a DNS record for ten years. Someone else got the IP, a certificate, and our subdomain. How dangling DNS becomes a subdomain takeover.

We're in the Japanese celebrity gossip site business now. A DNS record we forgot for ten years pointed at an IP we gave up. Some jerk got the IP, a Let's Encrypt cert, and a spam site The cert sat in our own CT tool the whole time. www.certkit.io/blog/danglin...

1 July

I have spent ten years building tools because certificates kept breaking things at the worst possible time. Talking through the 47-day shift on RunAs Radio reminded me how few people see it coming.

runasradio.com47 Day Certificates with Todd GardnerThe 47-day certificate is coming! While at NDC in Toronto, Richard received an update from Todd Gardner about his show last year: certificate authorities are moving toward SSL certificates that last o...

The longest SSL certificate you can buy today is 200 days. By 2029 it will be 47. Revocation never worked, so the industry is killing long lifespans instead. @toddhgardner.com broke down the why on RunAs Radio. runasradio.com/Shows/Show/1... #SSL #PKI

11 June

I hate demo environments. They answer "does this work ideally" which is not your question. June 16 I'm doing the real thing live with Richard Hicks. Come watch.

us02web.zoom.usWelcome! You are invited to join a webinar: Certificate Automation in Practice: A Technical Deep Dive for Windows IT. After registering, you will receive a confirmation email about joining the webinar...with Richard Hicks and Todd Gardner June 16 | 11:00am Central | 60 minutes | Free The first question most Windows IT teams have after deciding to automate certificate management isn't "should we do t...

Live SSL certificate deployment next week. Real setup, not a polished demo. If something breaks, we fix it on air. June 16, 11am Central. With Richard Hicks. us02web.zoom.us/webinar/regi... #CertificateManagement #WindowsIT

22 May

Hard to fake. An expert who's been doing web performance for a decade, switching tools and explaining exactly why. That's the kind of proof that actually means something.

Request Metrics@requestmetrics.com

Web performance agencies bill by the hour. Every hour spent hunting a root cause is one not spent fixing. @eroan.bsky.social found a CLS cause in 10 minutes on his first day with Request Metrics. Pages, element, fix. #WebPerformance #CLS

20 May

One of the first things a security audit asks for is an activity log. CertKit now has one. Every certificate action, logged, attributed, and flagged by importance.

When your auditor asks what happened to your certificates last Tuesday, you need an answer. CertKit now logs every action in your certificate lifecycle: issuances, renewals, revocations, deployments, agent approvals. With importance flags so you can find what matters. #CertificateManagement #PKI

Todd H. Gardner reposted

Every infra team has a folder called "cert scripts" with PowerShell nobody remembers writing. We built the thing that replaces it.

certkit.ioRemote deployment scriptingCertKit now ships centrally managed deployment scripts that push certificates directly to appliances, cloud platforms, and custom infrastructure, with a template library and encrypted variable storage...

F5 LTM. Palo Alto. Azure Key Vault. Exchange. We shipped a deployment scripting template library for all of them. Pick your target, configure your variables, and CertKit pushes the certificate to your infrastructure. www.certkit.io/blog/deploym... #CertificateManagement #PKI

5 May

50 SSL certificates managed manually means 50 renewals a year today. Same team, same certs, in 2029: 400. I did the math in this post.

certkit.ioCertificate lifetimes are shrinking.Certificate validity is dropping from 398 days to 47 days by 2029. Here is the canonical schedule, what's driving it, and what it does to your renewal workload.

50 SSL certificates managed manually today means roughly 50 renewals a year. Same team, same certs, in 2029: 400. The CA/Browser Forum's new lifetime schedule doesn't just change how often you renew. It changes the job. www.certkit.io/blog/shrinki... #PKI #SSL

27 Apr

Named a rule after myself. It felt right. Anyone who's been doing cert automation for a few years has accidentally built the thing I'm describing.

certkit.ioTodd's Tenth Rule of certificate automationAny sufficiently complicated SSL certificate renewal system contains an ad hoc, informally-specified, bug-ridden, slow implementation of half a certificate lifecycle manager. I'm taking credit for thi...

Philip Greenspun's Tenth Rule: any complicated C program contains a bad implementation of half of Lisp. Certificate automation has the same problem. Todd named it. www.certkit.io/blog/todds-t... #CertificateManagement #SysAdmin

17 Apr

Shipped remote agent updates and Google Trust Store support in CertKit this week. Two features I've been wanting to get out the door for a while.

certkit.ioRemote Agent Updates and Google Trust StoreAgent 1.9 adds remote push updates so you can upgrade your entire fleet from the dashboard, plus first-class support for Google Trust Store as an ACME certificate issuer alongside Let's Encrypt.

CertKit 1.9: push agent updates from the dashboard, no more logging into every server. Plus Google Trust Store as a second ACME issuer alongside Let's Encrypt. www.certkit.io/blog/agent-1.9 #CertificateManagement #SSL

usewhatworks.orgUse What Works - Choose proven solutions over building from scratchA manifesto for choosing proven solutions over bespoke frameworks. #UseWhatWorks

16 Apr

Most engineers undervalue their time. You have more important work to do than re-inventing the wheel.

Dylan Beattie@dylanbeatt.ie

"That's quite expensive. We'll just build our own." "Your library doesn't do what we need. Fix it now. For free." "Why do you want budget to pay for free software?" "You said this was free! How dare you charge money for the latest version!" Sound familiar? Help us fix it: usewhatworks.org

13 Apr

I spent a week on competitor websites before we launched. I couldn't figure out what a single one of them does. The security vendors selling you on "trust" are remarkably opaque.

certkit.ioPerformative Trust MaximalismCertificate management vendors use the word "trust" so often it stops meaning anything. They also won't tell you what the product does, or what it costs, without a sales call first. These are, I shoul...

One certificate management vendor used the word "trust" 17 times on their homepage. I still couldn't tell what they sell or what it costs. Apparently that's what the sales call is for. www.certkit.io/blog/perform... #PKI #cybersecurity

toddhgardner.comCertKit is Out of BetaWhy I built a certificate management platform, what's wrong with the way we handle certs today, and why CertKit exists as a commercial product now.

8 Apr

CertKit is out of beta today. After a year, 600+ beta users, and more Windows edge cases than I care to admit, it's a real product. www.toddhgardner.com/blog/certkit...

certkit.ioCertKit Agent 1.8: Windows RDP, Windows Certificate Store, and Java keystoresAgent 1.8 closes the last gaps in Windows and Java certificate deployment. Write directly into the Windows Certificate Store, auto-detect Remote Desktop and Remote Gateway, drop JKS files for legacy J...

1 Apr

The Windows Certificate Store integration in Agent 1.8 is going to eliminate a lot of the wrapper scripts I see. www.certkit.io/blog/agent-1.8

Yes, we shipped a retro MS-DOS modal today. No, it's not an April Fools joke. Agent 1.8 also adds Windows Certificate Store support, Java Keystore format, and RDP auto-detection. www.certkit.io/blog/agent-1.8 #CertificateManagement #Windows

30 Mar

Let's Encrypt quietly ran a mass revocation drill last week. 3 million real certificates. Most automation never noticed. That's the problem.

certkit.ioLet's Encrypt simulated revoking 3 million certificates. Most ACME clients didn't notice.Let's Encrypt ran their first annual mass revocation drill, shortening ARI renewal windows across 3 million production certificates. Here's what happened.

Let's Encrypt ran a mass revocation drill on 3 million production certificates in March 2026. They shortened ARI windows to simulate an emergency and watched who responded. Most ACME clients never noticed. www.certkit.io/blog/lets-en... #PKI #ACME

25 Mar

For the orgs that asked: yes, you can now use CertKit without sending us your private keys. The keystore runs on your infrastructure. Keys never leave.

certkit.ioCertKit Keystore: Private keys that never leave your infrastructureCertKit manages your certificates from issuance through deployment. For most organizations, that includes holding your private keys. For some, that's a hard no. The Local Keystore is for them.

Your security policy says private keys can't leave the network. Certificate automation says they have to. We just fixed that. www.certkit.io/blog/certkit-keystore #PKI #CertificateManagement

23 Mar

The forums answer for deploying certs to multiple servers is always "just write a script." That script quietly becomes the most critical unmonitored piece of infrastructure you own.

certkit.ioCertificate distribution is the last mile nobody solvedCertbot solved certificate issuance. It's great at that. The hard part is everything that happens after: getting the certificate file to every server that needs it, in the right format, with the right...

Epic Games had a wildcard cert expire in 2021. Monitoring caught it in 12 minutes. Recovery took 5.5 hours and 25 people. The cert renewed fine. Distribution is where it fell apart. www.certkit.io/blog/certifi... #PKI #TLS

16 Mar

ARI is the protocol that makes mass revocation survivable. Most ACME clients aren’t using it right. Cron jobs don’t cut it when the CA needs a response in 6 hours.

certkit.ioACME Renewal Information (ARI) solves mass certificate revocationWhen a CA has to revoke hundreds of thousands of certificates on a short deadline, email notifications aren't enough. ARI is the protocol that lets the CA tell your client directly: renew now. Here's ...

Mass certificate revocation isn’t a fire drill. It’s a 24-hour clock with thousands of certs on the line. ARI (RFC 9773) was built to handle exactly this. But it only works if your ACME client is actually listening. www.certkit.io/blog/ari-sol... #PKI #TLS

11 Mar

We added ARI so when a CA has to pull 83,000 certs overnight (hi DigiCert), it's just a quiet Tuesday. Certificate emergencies are getting boring.

certkit.ioACME ARI support and 6-day certificatesCertKit now polls Let's Encrypt multiple times a day to check when each certificate should renew. That means mass revocations happen automatically, without you doing anything. We also added support fo...

CertKit now supports ACME ARI and 6-day certificates. ARI means the CA tells us when to renew. We check it multiple times a day. The next mass revocation event will be boring for you. www.certkit.io/blog/acme-ar... #PKI #TLS

9 Mar

Renewed doesn't mean deployed. Certificate automation has a verification gap that almost nobody closes, and the consequences are getting worse as cert lifetimes shrink.

certkit.ioHow to verify certificate renewal actually workedCertbot ran. The logs show success. Exit code 0. LinkedIn found out the hard way that renewed and deployed are not the same thing. The verify step is the part of certificate automation nobody builds u...

Your certificate renewed. The old one is still serving. Certbot solves "I forgot to renew." It doesn't tell you whether the new cert actually made it to your server. LinkedIn learned this the hard way in 2019. www.certkit.io/blog/how-to-... #PKI #TLS

4 Mar

Certificate expiration is a team problem that keeps getting assigned to one person. We just shipped the tools to fix that.

certkit.ioUser management, MFA, SSO, and weekly summaries are liveCertKit now supports team accounts with role-based access, multi-factor authentication, SAML single sign-on, and a weekly email digest. Here's what shipped and why it matters.

Certificate management has always been a one-person job. Until something breaks, everyone ignores it. Until that one person leaves. CertKit now supports team access: roles, SAML SSO, MFA, and a weekly email digest. www.certkit.io/blog/user-ma... #CertKit #PKI

3 Mar

GitHub felt more reliable when it was a pile of ruby on rails and a fistful of dreams.

2 Mar

Get your last 1 year SSL certificates now, while the gettin is good.

certkit.ioLast call on 398-day certificatesThe bar closes March 15. After that, no CA can serve you a 398-day certificate. If you're still managing commercial SSL certs manually, you have two weeks to grab one last round of full-year runway be...

March 15 is the last day to issue a certificate with ~1 year of validity. After that, 200-day max. Then 100 in 2027. Then 47 in 2029. Renew now and you set your own automation schedule. Wait, and the CA/B Forum sets it for you. www.certkit.io/blog/last-ca... #PKI #CertificateManagement

trackjs.comHow to Debug Code You Didn’t Write (your AI did)AI-generated code looks great in the diff and breaks on the first edge case. Here’s how to debug JavaScript you didn’t write without reverse-engineering someone else’s bad assumptions.

26 Feb

New post. AI code looks great in the diff and breaks on the first edge case. The instinct is to reverse-engineer the author's assumptions, but that approach is slow and usually wrong.

TrackJS@trackjs.com

Whatever autocomplete casino your team is using this week, the bug report still lands on your desk like you wrote it yourself. Here's how to debug code you didn't write (and didn't break). trackjs.com/blog/how-to-debug-code-you-didnt-write/ #JavaScript #debugging

25 Feb

If you’re still treating cert renewals like a calendar reminder, March is gonna be spicy.

certkit.ioCertKit Agent update: RRAS support, deploy windows, and agent lockingThe CertKit Agent now supports Microsoft RRAS for VPN certificate management. We also added deploy windows so you can control when certificate updates happen, and agent locking to protect your infrast...

CertKit Agent 1.6 is out: Microsoft RRAS support, deploy windows, and agent locking. Shorter cert lifetimes mean certificate automation has to act like real releases: issue, deploy, verify (and do it on your schedule). www.certkit.io/blog/agent-1.6 #CertificateAutomation #SysAdmin

Todd H. Gardner reposted

Disney Prime Video + ᵖᵃʳᵒᵈʸ

@disneyprimevideo.bsky.social

24 Feb

Replying to @disneyprimevideo.bsky.social

23 Feb

This is one of my favorite cybersecurity posts we've done. I dug into the data on MITM attacks and the threat model most of us worry about is basically fiction.

certkit.ioHow likely is a man-in-the-middle attack?A stolen TLS private key sounds catastrophic. But thanks to forward secrecy, it can't decrypt recorded traffic. The only thing left is server impersonation, and that requires network position that ran...

Man-in-the-middle attacks are less than 4% It's mostly phishing proxies, not TLS interception. The attack every vendor warns about almost never happens. What actually compromises your connections? www.certkit.io/blog/man-in-...

Todd H. Gardner reposted

KAL

@blueflafighter.bsky.social

23 Feb

The ICE surge in Minnesota cost $280M, to detain 4k people of whom only 30 were accused of violent crimes. $9 million per capture of the "worst of the worst". Plus two citizens murdered. ~ Veterans for Peace

trackjs.comWho Watches the Vibe Coder?AI is shipping JavaScript faster than humans can review it. And a lot of it is “looks fine to me” code that explodes in production. You can’t code review vibes, so you need production visibility.

19 Feb

I keep seeing AI-generated diffs that are plausible and wrong in the most annoying ways: missing guards, cargo-cult hooks, swallowed promises. If your review is vibes, you’re gambling. Production has receipts.

TrackJS@trackjs.com

Vibe coding ships fast. Then prod finds the one weird browser + slow network combo and your “looks fine” code catches fire. You can’t code review vibes, you need production visibility. trackjs.com/blog/who-wat... #JavaScript #WebDev

17 Feb

My first published software was part of a level pack for Duke Nukem.

Retro Tech Dreams@retrotechdreams.bsky.social

Duke Nukem 3D (1996)

Todd H. Gardner reposted

NY Times Pitchbot

@nytpitchbot.bsky.social

16 Feb

We wanted to understand how rugged English-Scots-Irish culture has shaped America. So we talked to three white South African billionaires at a sex party in the Bahamas.

16 Feb

BygoneSSL isn't theoretical. We found a valid certificate on our own domain, issued to someone we've never met. Getting it revoked was an experience.

certkit.ioBygoneSSL happened to usWe wrote about BygoneSSL and the 1.5 million domains with certificates owned by someone else. Then we bought certkit.dev and found one on our own domain. A DigiCert certificate, still valid for 98 day...

We bought certkit<.>dev and found someone else had a valid certificate for it. Tried to get it revoked: 6 emails, 24 hours, a support agent who called me "Tobb." 72 hours later, the cert is STILL trusted by every browser. www.certkit.io/blog/bygones... #WebPKI #CertificateManagement

15 Feb

“Go to sleep with itchy butt, wake up with stinky finger” This game was such a gem for teenage todd 🤣

Retro Tech Dreams@retrotechdreams.bsky.social

Shadow Warrior (1997)

buff.lyJikipedia turns Epstein’s emails into an encyclopedia of the his powerful friendsAI-generated dossiers from the Jmail team.

15 Feb

It’s weird to see people who aren’t from Minnesota talking about Minnesota.

Todd H. Gardner reposted

The Verge

@theverge.com

14 Feb

Jikipedia turns Epstein’s emails into an encyclopedia of the his powerful friends

Todd H. Gardner reposted

NDC Conferences

@ndcconferences.com

14 Feb

📢 Attention Software Developers! The #EarlyBird ticket offer for NDC Toronto closes this Monday, Feb 16th 🇨🇦 Join @stevesanderson.bsky.social and 55 other industry experts for 4 days of learning, networking, and fun! Secure your spot 👉 ndctoronto.com

Todd H. Gardner reposted

Request Metrics

@requestmetrics.com

13 Feb

Your Speed Index is bad but the page looks fine? Lighthouse records a video of your page loading and scores how fast the viewport fills in. Not just the first pixel, the whole visual experience. requestmetrics.com/web-performa... #WebPerf

requestmetrics.comUnderstanding Lighthouse: Speed IndexLighthouse says: "Speed Index shows how quickly the contents of a page are visibly populated." It sounds simple. It is not. Here's what it actu...

12 Feb

“Certificate automation” that ends at issuance is wishful thinking. CertKit Agent is issue, deploy, verify, plus the boring stuff like perms and restarts.

certkit.ioIntroducing the CertKit AgentCertKit can now deploy certificates directly to your servers. The CertKit Agent is a lightweight service for Linux, Windows, and Docker that detects your software, writes certificates where they need ...

Most “certificate automation” stops at issuance. That’s how you renew a cert but still serve the old one. CertKit Agent closes the loop: issue, deploy, verify. Write files to the right paths, set perms/ownership, run the restart. www.certkit.io/blog/certkit... #PKI #DevOps

10 Feb

I want to have a test Windows Server/IIS Server to test integrations with @certkit.io. It doesn't need to save any state. Microsoft friends, what's the best way to do this?

booz.barSample Bar - Bar InventoryExplore our sample bar inventory - spirits, cocktails, beer, and wine. Check what's available now!

10 Feb

Already tried: - I can't get the servercore VM on my ARM64 mac. - DigitalOcean doesn't support Windows - Azure wants to charge me $90/mo for the smallest VM that can run it.

Todd H. Gardner reposted

Lemon

@ahoylemon.xyz

9 Feb

I made a little software platform for people to keep track of what's in their home bar. hmu if you wanna try it out yourself. booz.bar/about/

9 Feb

Certbot exiting 0 is not success. If you’re not deploying everywhere and verifying a real TLS handshake, you didn’t automate anything.

certkit.ioIssuance Automation vs Certificate AutomationMost teams “automate certificates” by installing an ACME client and calling it a day. Then they still ship an outage because the hard parts were never automated: knowing what exists, keeping validatio...

You “automated certificates” with Certbot… and still got paged at 2am for an expired cert. Because you automated issuance, not certificate automation. The hard parts are deploy + verify. www.certkit.io/blog/issuanc... #ACME #CertificateManagement

Todd H. Gardner reposted

Request Metrics

@requestmetrics.com

6 Feb

Lighthouse’s “First Meaningful Paint” sounds important. It isn’t. It’s deprecated, misleading, and still confusing people into fixing the wrong stuff. Here’s what FMP actually was, why Google killed it, and what to watch instead. requestmetrics.com/web-performa... #webperf #corewebvitals

requestmetrics.comUnderstanding Lighthouse: First Meaningful PaintLighthouse says: "First Meaningful Paint measures when the primary content of a page is visible." But FMP is deprecated. Here's why Google kill...

trackjs.comHow to fix `undefined is not an object (evaluating 'window.webkit.messageHandlers')`Safari throws this when JavaScript tries to call the WKWebView native bridge, but the page is running in a normal browser context where `window.webkit.messageHandlers` doesn't exist. Fix it with featu...

3 Feb

I’ve debugged this exact Safari error way too many times. It usually shows up after someone copies WKWebView code into a regular browser context and everything explodes. If this feels familiar, you’re not alone.

TrackJS@trackjs.com

Safari throwing “undefined is not an object (evaluating 'window.webkit.messageHandlers')”? It’s not random. It’s WKWebView doing WKWebView things. What it means, why it happens, and how to fix it: trackjs.com/javascript-e... #javascript #safari

2 Feb

We spent years with rsync cron jobs and Ansible playbooks distributing certificates. Turns out we'd poorly reinvented centralized certificate management. Wrote about why CertBot's model breaks.