Curious how CertKit works? certkit.io/how-it-works

Starting tomorrow, Chrome shows NET::ERR_CERT_AUTHORITY_INVALID for InCommon SSL certificates on eMudhra's ECC root. 3,134 at 41 schools still chain to it. Skip eMudhra RSA, it's leaving too. Move once: certkit.io/blog/incommon-err… #PKI #SSL

Chrome stops trusting eMudhra's ECC root Tuesday. And eMudhra is leaving the TLS business, so InCommon certificates reissued on its RSA chain will have to move again. Move once. We can help this weekend. certkit.io/blog/emudhra-inte… #PKI #SSL

-----BEGIN EC PRIVATE KEY----- 4 -----END EC PRIVATE KEY----- That's they key behind Internet2's InCommon SSL. The root gets distrusted on Tuesday, and about 30K certificates need to get replaced. certkit.io/blog/emudhra-inte… #PKI #SSL

We had 35 built-in SSL certificate deployment templates in July. It's 86 now! New: A10 Thunder, Cisco ISE, VMware Horizon, OpenVPN, WatchGuard, and IBM i. certkit.io/blog/certificate-… #SSL #PKI

DigiCert, Sectigo, and Let's Encrypt have all changed their SSL certificate chains since 2025. An old chain file now passes in Chrome and fails in curl with "unable to get local issuer certificate." certkit.io/blog/unable-to-ge… #SSL #PKI

The NSA said stop using wildcard SSL certificates in 2021. We counted every active cert in the CT logs. 38% of domains run a wildcard. In .bank it's 79%. The most automated operators use them most. certkit.io/blog/wildcard-cer… #SSL #PKI

The last publicly trusted client auth certificates from Let's Encrypt expired this week. If your mTLS setup is still running on one, it stopped renewing in July. There is nothing behind it. certkit.io/blog/public-mtls-…

Check any server's SSL certificate chain and post-quantum readiness with our free tools. No account needed. As of today, CertKit monitoring runs the same checks on your hosts, alongside expiry. certkit.io/blog/certificate-… #TLS #PQC

Let's Encrypt promised DNS-PERSIST-01 by Q2. It's October. A 2024 ballot fight, a security hole found in April, and a September rewrite that broke every early record. Our guess is mid-2027. certkit.io/blog/whats-taking… #LetsEncrypt #PKI

"Where is the SSL certificate for examplecom?" is now one search across every client you manage. New in CertKit: cross-collection search, a dashboard with a 90-day renewal timeline, and a read-only API for dashboards and invoices. certkit.io/blog/certkit-for-…

SSTP, DirectAccess, RD Gateway, IIS, Exchange, ADFS. None run an ACME client, and every renewal touches a binding, a restart, or a reboot. Oct 6, @richardhicks and I automate all of it. Bring the appliance nobody has given you a straight answer on: events.teams.microsoft.com/e…

The certificate Common Name was deprecated in 2000. We checked 3 billion certs in CT logs and 96% still have one. Browsers ignore it. GlobalProtect, Cisco Umbrella, NetScaler, and Exchange don't. certkit.io/blog/does-a-tls-c… #PKI #SSL

Apple's draft policy for Merkle Tree Certificates caps validity at 7 days. Not a shorter X.509. A new post-quantum cert type, validated from periodic out-of-band client updates, so it only has to outlive the update cycle. 7 days costs nothing when nothing human renews it. #PKI

Some jerk got an SSL certificate for a subdomain we had forgotten about, and Google told us before our own CT log tool did. Now CertKit watches the log. You get an email when a certificate shows up for a name it has never seen on your domain. certkit.io/blog/ct-alerts

Your once-a-year SSL renewal becomes a five-times-a-year renewal on March 15, when public cert lifetimes drop from 200 days to 100. At 47 days, twelve. Oct 6, live with @richardhicks on automating renewal for Windows servers, VPN, and appliances. Free: events.teams.microsoft.com/e…

We're in the Japanese celebrity gossip site business now. A DNS record we forgot for ten years pointed at an IP we gave up. Some jerk got the IP, a Let's Encrypt cert, and a spam site. The cert sat in our own CT tool the whole time. certkit.io/blog/dangling-dns…

Cloud SSL certificate monitoring only sees what the internet sees. Your intranet pages expire too, but they don't warn anyone first. CertKit agents now monitor SSL certificates inside your network, and judge trust from the host's own trust store. certkit.io/blog/certificate-… #PKI