mastodon 4.8.0-alpha.3+glitchAutomated SSL certificate management for IT teams who have better things to do. No scripts, no cron jobs. Free 90-day trial to start renewing your certificates.
I spent months telling people not to run their own CA.
Today CertKit ships Private PKI. Running a CA is a job, so we took the job. SSL certs for mTLS, IPs, and internal names, root auto-installed on deploy.
Let's Encrypt drops cert lifetimes to 45 days by Feb 2028, a year early.
CertKit now supports their TLS Server profile, so you can issue 45-day certs today and test your automation before the deadline.
Managing SSL certs for clients? New: managed accounts. An MSP sets up the client's CertKit account, deploys certs and agents, then hands it over.
Client owns it. You keep audited support access.
CertKit Agent 1.8: Windows Certificate Store, Java Keystore, and RDP auto-detection.
We also shipped a retro MS-DOS confirmation dialog on April Fools Day. It is fully keyboard-compatible.
https://www.certkit.io/blog/agent-1.8 #CertificateManagement #PKI
Let's Encrypt ran a mass revocation drill on 3 million production certificates in March. No user notifications. They shortened ARI windows to signal an emergency and watched who responded.
Most ACME clients never noticed.
https://www.certkit.io/blog/lets-encrypt-mass-revocation-simulation
A 2024 PKI survey found organizations averaged 3 certificate outages over 24 months. In almost every case, the certificate renewed fine.
Distribution is where it fell apart.
https://www.certkit.io/blog/certificate-distribution-is-the-last-mile #PKI #infosec
Certificate management has always been a one-person job. CertKit now supports team access: role-based permissions, SAML SSO, MFA, and a weekly digest to keep the whole org in the loop.
Security vendors use "trust" as a magic spell. One homepage: 17 uses. I still don't know what they sell. You find out after you fill out a form, take a call, sit through a demo, and receive a market-ecture PDF.
Some organizations have a hard requirement: private keys cannot leave the network perimeter. Third-party cert management has always meant violating that policy.
The CertKit Local Keystore is the fix. Keys stay on your infrastructure. Full automation still works.
www.certkit.io/blog/certkit-keystore
Your cert renewed. The old one is still serving.
LinkedIn renewed 10 days before expiry. It never deployed.
Most automation catches "forgot to renew." Nobody verifies the new cert is what the server is actually sending.
https://www.certkit.io/blog/how-to-verify-certificate-renewal #PKI #TLS
22,000+ incidents in the Verizon DBIR. Man-in-the-middle? Less than 4%, mostly phishing proxies. Not TLS interception.
Forward Secrecy killed "record now, decrypt later." So what actually compromises your connections?
We found a valid DigiCert certificate on a domain we just purchased, issued to someone we've never met. Getting it revoked took 6 emails. 72 hours after confirmed revocation, every browser still trusts it.
Most “certificate automation” stops at issuance. That’s how you renew a cert and still serve the old one.
With the CertKit agent, we can now do all three. Renew certs, deploy files, restart services, verify the correct certs run in production.
March 15 is last call on 398-day certificates. After that, 200-day max, 100 in 2027, 47 in 2029.
Renew now and you buy yourself time to automate on your terms. Wait, and the CA/B Forum sets your schedule for you.
https://www.certkit.io/blog/last-call-on-398-day-certificates #PKI #WebPKI
Let's Encrypt is going post-quantum. I'm not worried about quantum computers.
The real story in Merkle Tree Certificates: smaller handshakes, transparency built in, and even shorter cert lifetimes.
https://www.certkit.io/blog/quantum-is-the-least-interesting-part
CertKit 1.9: push agent updates from the dashboard, no more logging into every server. Plus Google Trust Store as a second ACME issuer alongside Let's Encrypt.
CertKit is out of beta.
600 signups. Real production deployments. A Keystore for keeping private keys on-prem. RDP and RRAS support for Windows shops.
Now there's real pricing — and 40% off forever if you get in before May 31st.
PSA: You don't need a private CA for internal SSL certificates.
The CA doesn't connect to your server. It checks a DNS record. Your server can be completely unreachable from the internet.
https://www.certkit.io/blog/private-pki-internal-infrastructure
Mass revocation gives you 24 hours and thousands of certs to replace. ARI (RFC 9773) automates it, but only if your ACME client is always running.
Certbot uses a cron job. acme.sh has no ARI support.
https://www.certkit.io/blog/ari-solves-mass-certificate-revocation
PKI has a term for the leaf-to-root trust chain. It has no term for the series of certs you've been renewing for years.
Certbot calls it a lineage. Nobody else picked it up. At 47-day lifetimes, naming this correctly starts to matter.
Compliance audits ask who touched your certificates, when, and why.
CertKit now captures every certificate action with timestamps and user attribution. Importance flags let you cut through routine events to the ones with real consequences.
CertKit now supports ACME ARI and 6-day certificates.
ARI means the CA tells us when to renew. We check it multiple times a day. Your next mass revocation event? Just another boring Tuesday.
Nothing to configure.
https://www.certkit.io/blog/acme-ari-and-6-day-certificates #PKI #infosec
Curious how CertKit works? I made a page for that.
CertKit Agent 1.6: RRAS support, deploy windows, and agent locking.
Shorter lifetimes mean certificate automation has to act like real deployments: issue, deploy, verify. Deploy windows keep disruptions inside maintenance windows, and agent locking freezes commands so UI changes can’t be weaponized.
One SonicWall. The SSL certificate import API is barely documented and shifts between SonicOS versions. Now repeat for every appliance you run, up to 12x a year.
Build it yourself and you maintain it forever.
https://www.certkit.io/blog/automating-sonicwall-certificates
Live SSL certificate deployment next week. Not a demo environment. Real setup, discovery through renewal. If something breaks, we fix it.
June 16, 11am Central. With Richard Hicks. Free.
https://us02web.zoom.us/webinar/register/6417812064399/WN_iBrdj5xmT56lUWG1jrf3ZQ
Apple's 398-day limit exempts private CAs. Most people stopped reading there.
There's a second Apple requirement: all TLS certs, 825 days max. Safari silently rejects anything longer. No bypass, no details.
https://www.certkit.io/blog/apple-doesnt-care-who-signed-your-certificate
