Every collection and client on one page, a search that finds any certificate, host, or agent, a new dashboard, and a read-only API for the rest.

Microsoft Virtual Events Powered by Teams

The certificate Common Name has been deprecated for decades, but your load balancer and Exchange connectors might not have gotten the memo.

CertKit now watches certificate transparency logs for your domains and emails you when a certificate appears that you have never seen before.

Microsoft Virtual Events Powered by Teams

We forgot a DNS record for ten years. Someone else got the IP, a certificate, and our subdomain. How dangling DNS becomes a subdomain takeover.

CertKit agents now monitor TLS endpoints inside your network, judge trust from the host's trust store, and re-check hosts the moment a certificate deploys.

There is a permanent public record of every certificate ever issued for your domain. You never agreed to it and you can't opt out. I read ours, and it names our dev servers and most of our vendors.

Two RFCs in July took away three of TLS 1.2's key exchange methods and its entire future. The banned ones ship enabled by default in nginx, Apache, and Windows Server, which means you are probably sti...

I spent months telling you not to run your own certificate authority. Today CertKit ships Private PKI. Both things are true, because the job was the problem, and we took the job.

Chrome's root program is pulling mTLS client authentication out of the public web PKI. Let's Encrypt got there first, and the last client certificates they issued expire in early October.

The 47-day certificate is coming! While at NDC in Toronto, Richard received an update from Todd Gardner about his show last year: certificate authorities are moving toward SSL certificates that last o...

Every HTTPS connection starts with a TLS handshake. Most explanations walk the steps without telling you why they exist, or why half the steps you learned no longer happen. The modern handshake is sho...

The old deployment flow expected you to know certificate formats, store locations, and your way around a script editor. The new one asks for a template, a name, and a certificate. That's it.

The 47-day certificate is coming! While at NDC in Toronto, Richard received an update from Todd Gardner about his show last year: certificate authorities are moving toward SSL certificates that last o...

Generating the private key on the server it protects is the textbook answer. Then someone asks for a wildcard, or a second server, and the textbook doesn't have a chapter for that.

Certificate lifetimes are shrinking to 47 days. Manually updating SSL certificates through the SonicWall Administration UI is no longer an option. We automate the process, but SonicOS doesn't make it ...

The 47-day certificate is coming! While at NDC in Toronto, Richard received an update from Todd Gardner about his show last year: certificate authorities are moving toward SSL certificates that last o...

Let's Encrypt just committed to Merkle Tree Certificates for a post-quantum web. I don't think quantum computers are close. The plan is still worth your attention, just not for the reason the headline...

with Richard Hicks and Todd Gardner June 16 | 11:00am Central | 60 minutes | Free The first question most Windows IT teams have after deciding to automate certificate management isn't "should we do t...

PKI has precise terminology for almost everything. The one thing it never named is the series of certificates you've been renewing for years. Here's what it is, why it matters now, and why your tools ...

MSPs can now stand up fully-managed CertKit accounts for their clients, deploy certificates and agents, then hand over the keys. We also added support for Let's Encrypt's TLS Server profile, so you ca...

MSPs can now stand up fully-managed CertKit accounts for their clients, deploy certificates and agents, then hand over the keys. We also added support for Let's Encrypt's TLS Server profile, so you ca...

Running a private CA to escape the public cert treadmill makes sense. Apple still enforces an 825-day validity limit in Safari on every TLS certificate, no matter who issued it.

Most teams assume internal infrastructure needs a private CA. It doesn't - and skipping it saves you from a maintenance burden that never fully works anyway.

CertKit now ships centrally managed deployment scripts that push certificates directly to appliances, cloud platforms, and custom infrastructure, with a template library and encrypted variable storage...

Certificate validity is dropping from 398 days to 47 days by 2029. Here is the canonical schedule, what's driving it, and what it does to your renewal workload.

On May 26, I'm doing a 30-minute live session with Richard Hicks on what actually works for SSL certificate automation in Windows environments. VPNs, IIS, RRAS, vendor appliances, the endpoints that c...

Any sufficiently complicated SSL certificate renewal system contains an ad hoc, informally-specified, bug-ridden, slow implementation of half a certificate lifecycle manager. I'm taking credit for thi...

Copy and share agent configurations across your fleet, search and sort your monitored domains, and our first official Data Processing Agreement for GDPR compliance.