iiinova — where your digital self keeps evolving

Todd H. Gardner @toddhgardner.com · 22/09/2026

We sell CT log search, and Google told us about our own subdomain takeover. Now we're in Japanese celebrity gossip. Wrote it up, including the alert we hadn't shipped yet.

110

Todd H. Gardner @toddhgardner.com · 01/07/2026

I have spent ten years building tools because certificates kept breaking things at the worst possible time. Talking through the 47-day shift on RunAs Radio reminded me how few people see it coming.

000

Todd H. Gardner @toddhgardner.com · 11/06/2026

I hate demo environments. They answer "does this work ideally" which is not your question. June 16 I'm doing the real thing live with Richard Hicks. Come watch.

000

Todd H. Gardner @toddhgardner.com · 22/05/2026

Hard to fake. An expert who's been doing web performance for a decade, switching tools and explaining exactly why. That's the kind of proof that actually means something.

021

Todd H. Gardner @toddhgardner.com · 20/05/2026

One of the first things a security audit asks for is an activity log. CertKit now has one. Every certificate action, logged, attributed, and flagged by importance.

000

Reposted by Todd H. Gardner

Request Metrics @requestmetrics.com · 20/05/2026

Web performance agencies bill by the hour. Every hour spent hunting a root cause is one not spent fixing. @eroan.bsky.social found a CLS cause in 10 minutes on his first day with Request Metrics. Pages, element, fix. #WebPerformance #CLS

031

Todd H. Gardner @toddhgardner.com · 08/05/2026

Every infra team has a folder called "cert scripts" with PowerShell nobody remembers writing. We built the thing that replaces it.

010

Todd H. Gardner @toddhgardner.com · 05/05/2026

50 SSL certificates managed manually means 50 renewals a year today. Same team, same certs, in 2029: 400. I did the math in this post.

000

Todd H. Gardner @toddhgardner.com · 27/04/2026

Named a rule after myself. It felt right. Anyone who's been doing cert automation for a few years has accidentally built the thing I'm describing.

000

Todd H. Gardner @toddhgardner.com · 17/04/2026

Shipped remote agent updates and Google Trust Store support in CertKit this week. Two features I've been wanting to get out the door for a while.

000

Todd H. Gardner @toddhgardner.com · 16/04/2026

Most engineers undervalue their time. You have more important work to do than re-inventing the wheel.

063

Todd H. Gardner @toddhgardner.com · 13/04/2026

I spent a week on competitor websites before we launched. I couldn't figure out what a single one of them does. The security vendors selling you on "trust" are remarkably opaque.

001

Todd H. Gardner @toddhgardner.com · 08/04/2026

CertKit is out of beta today. After a year, 600+ beta users, and more Windows edge cases than I care to admit, it's a real product. www.toddhgardner.com/blog/certkit...

toddhgardner.com

CertKit is Out of Beta

Why I built a certificate management platform, what's wrong with the way we handle certs today, and why CertKit exists as a commercial product now.

010

Todd H. Gardner @toddhgardner.com · 30/03/2026

Let's Encrypt quietly ran a mass revocation drill last week. 3 million real certificates. Most automation never noticed. That's the problem.

000

Todd H. Gardner @toddhgardner.com · 25/03/2026

For the orgs that asked: yes, you can now use CertKit without sending us your private keys. The keystore runs on your infrastructure. Keys never leave.

000

Todd H. Gardner @toddhgardner.com · 23/03/2026

The forums answer for deploying certs to multiple servers is always "just write a script." That script quietly becomes the most critical unmonitored piece of infrastructure you own.

000

Todd H. Gardner @toddhgardner.com · 16/03/2026

ARI is the protocol that makes mass revocation survivable. Most ACME clients aren’t using it right. Cron jobs don’t cut it when the CA needs a response in 6 hours.

001

Todd H. Gardner @toddhgardner.com · 11/03/2026

We added ARI so when a CA has to pull 83,000 certs overnight (hi DigiCert), it's just a quiet Tuesday. Certificate emergencies are getting boring.

000

Todd H. Gardner @toddhgardner.com · 09/03/2026

Renewed doesn't mean deployed. Certificate automation has a verification gap that almost nobody closes, and the consequences are getting worse as cert lifetimes shrink.

000

Todd H. Gardner @toddhgardner.com · 04/03/2026

Certificate expiration is a team problem that keeps getting assigned to one person. We just shipped the tools to fix that.

010

Todd H. Gardner @toddhgardner.com · 03/03/2026

GitHub felt more reliable when it was a pile of ruby on rails and a fistful of dreams.

030

Todd H. Gardner @toddhgardner.com · 02/03/2026

Get your last 1 year SSL certificates now, while the gettin is good.

010

Todd H. Gardner @toddhgardner.com · 26/02/2026

New post. AI code looks great in the diff and breaks on the first edge case. The instinct is to reverse-engineer the author's assumptions, but that approach is slow and usually wrong.

220

Todd H. Gardner @toddhgardner.com · 25/02/2026

If you’re still treating cert renewals like a calendar reminder, March is gonna be spicy.

000

Todd H. Gardner @toddhgardner.com · 23/02/2026

This is one of my favorite cybersecurity posts we've done. I dug into the data on MITM attacks and the threat model most of us worry about is basically fiction.

020

Reposted by Todd H. Gardner

KAL @blueflafighter.bsky.social · 23/02/2026

The ICE surge in Minnesota cost $280M, to detain 4k people of whom only 30 were accused of violent crimes. $9 million per capture of the "worst of the worst". Plus two citizens murdered. ~ Veterans for Peace

12246002078

Todd H. Gardner @toddhgardner.com · 19/02/2026

I keep seeing AI-generated diffs that are plausible and wrong in the most annoying ways: missing guards, cargo-cult hooks, swallowed promises. If your review is vibes, you’re gambling. Production has receipts.

000

Todd H. Gardner @toddhgardner.com · 17/02/2026

My first published software was part of a level pack for Duke Nukem.

010

Reposted by Todd H. Gardner

NY Times Pitchbot @nytpitchbot.bsky.social · 16/02/2026

We wanted to understand how rugged English-Scots-Irish culture has shaped America. So we talked to three white South African billionaires at a sex party in the Bahamas.

302600515

Todd H. Gardner @toddhgardner.com · 16/02/2026

BygoneSSL isn't theoretical. We found a valid certificate on our own domain, issued to someone we've never met. Getting it revoked was an experience.

010

Todd H. Gardner @toddhgardner.com · 15/02/2026

“Go to sleep with itchy butt, wake up with stinky finger” This game was such a gem for teenage todd 🤣

010

Todd H. Gardner @toddhgardner.com · 15/02/2026

It’s weird to see people who aren’t from Minnesota talking about Minnesota.

010

Reposted by Todd H. Gardner

NDC Conferences @ndcconferences.com · 14/02/2026

📢 Attention Software Developers! The #EarlyBird ticket offer for NDC Toronto closes this Monday, Feb 16th 🇨🇦 Join @stevesanderson.bsky.social and 55 other industry experts for 4 days of learning, networking, and fun! Secure your spot 👉 ndctoronto.com

022

Reposted by Todd H. Gardner

Request Metrics @requestmetrics.com · 13/02/2026

Your Speed Index is bad but the page looks fine? Lighthouse records a video of your page loading and scores how fast the viewport fills in. Not just the first pixel, the whole visual experience. requestmetrics.com/web-performa... #WebPerf

requestmetrics.com

Understanding Lighthouse: Speed Index

Lighthouse says: "Speed Index shows how quickly the contents of a page are visibly populated." It sounds simple. It is not. Here's what it actu...

031

Todd H. Gardner @toddhgardner.com · 12/02/2026

“Certificate automation” that ends at issuance is wishful thinking. CertKit Agent is issue, deploy, verify, plus the boring stuff like perms and restarts.

000

Todd H. Gardner @toddhgardner.com · 10/02/2026

I want to have a test Windows Server/IIS Server to test integrations with @certkit.io. It doesn't need to save any state. Microsoft friends, what's the best way to do this?

100

Reposted by Todd H. Gardner

Lemon @ahoylemon.xyz · 09/02/2026

I made a little software platform for people to keep track of what's in their home bar. hmu if you wanna try it out yourself. booz.bar/about/

booz.bar

Sample Bar - Bar Inventory

Explore our sample bar inventory - spirits, cocktails, beer, and wine. Check what's available now!

031

Todd H. Gardner @toddhgardner.com · 09/02/2026

Certbot exiting 0 is not success. If you’re not deploying everywhere and verifying a real TLS handshake, you didn’t automate anything.

010

Reposted by Todd H. Gardner

Request Metrics @requestmetrics.com · 06/02/2026

Lighthouse’s “First Meaningful Paint” sounds important. It isn’t. It’s deprecated, misleading, and still confusing people into fixing the wrong stuff. Here’s what FMP actually was, why Google killed it, and what to watch instead. requestmetrics.com/web-performa... #webperf #corewebvitals

requestmetrics.com

Understanding Lighthouse: First Meaningful Paint

Lighthouse says: "First Meaningful Paint measures when the primary content of a page is visible." But FMP is deprecated. Here's why Google kill...

022

Todd H. Gardner @toddhgardner.com · 03/02/2026

I’ve debugged this exact Safari error way too many times. It usually shows up after someone copies WKWebView code into a regular browser context and everything explodes. If this feels familiar, you’re not alone.

000

Todd H. Gardner @toddhgardner.com · 02/02/2026

We spent years with rsync cron jobs and Ansible playbooks distributing certificates. Turns out we'd poorly reinvented centralized certificate management. Wrote about why CertBot's model breaks.

000

Reposted by Todd H. Gardner

TrackJS @trackjs.com · 29/01/2026

Unexpected end of input errors in production? Your code is fine. The server returned nothing when your JSON parser expected data. Empty responses, HTML error pages, truncated network calls. trackjs.com/javascript-e... #JavaScript #WebDev

trackjs.com

How to fix `Unexpected end of input`

JavaScript parser error when code or JSON data is incomplete. Often caused by missing brackets, empty API responses, or truncated scripts. Quick fixes: check for unclosed braces, validate JSON before ...

021

Todd H. Gardner @toddhgardner.com · 27/01/2026

Let's Encrypt is going to 45-day certificates by February 2028. Authorization reuse drops to 7 hours. This will expose every shop that thought they had automation but really just had a cron job.

010

Reposted by Todd H. Gardner

Disney Prime Video + ᵖᵃʳᵒᵈʸ @disneyprimevideo.bsky.social · 02/07/2024

The Brave Little Guillotine (2025)

71158331

Reposted by Todd H. Gardner

Request Metrics @requestmetrics.com · 22/01/2026

Your hero image takes 5 seconds to show up? Users already hit the back button. That's Largest Contentful Paint killing your conversions and search rankings. Here's how to fix it: requestmetrics.com/web-performa... #WebPerf #CoreWebVitals

requestmetrics.com

Understanding Lighthouse: Largest Contentful Paint

Lighthouse says: "Largest Contentful Paint marks the time at which the largest text or image is painted." Here's what that means, why it matter...

021