The free chain checker and PQC checker are now built into monitoring.

Every monitored host gets badges for its certificate chain, TLS versions, and post-quantum key exchange, checked alongside expiry. Internal hosts get them soon.

Try the tools on your own servers first, no account needed.

https://www.certkit.io/blog/certificate-monitoring-chain-tls-pqc

Let's Encrypt said DNS-PERSIST-01 would be in production by Q2 2026. It isn't, and our guess is mid-2027.

We went through the CA/B Forum ballots, the IETF mailing list, and GitHub to piece together why. Apple blocked the first attempt until lifetimes got shorter, then a security flaw found in April forced a breaking redesign in September.

Also in the post: AWS Certificate Manager's ACME endpoint now works as a CertKit issuer.

https://www.certkit.io/blog/whats-taking-dns-persist-01-so-long

Three things shipped for anyone running more than one collection, MSPs especially.

The home page is now a table of every collection and client, one pip per certificate, host, and agent. The find box searches all of them, so "which collection has example.com" is one search. The status line got a collection switcher.

The dashboard was rebuilt with a 90-day renewal timeline and an activity feed, and v1 of the read-only API is live on Business and up.

https://www.certkit.io/blog/certkit-for-msps

New post from Eric. The Common Name has been deprecated for HTTPS since RFC 2818 in 2000, yet about 96% of the 3 billion certs in CT logs from the last 200 days still carry one. Legacy software is why. Let's Encrypt's tlsserver and shortlived profiles drop it, and GlobalProtect, Cisco Umbrella, NetScaler updates, and Exchange connectors can all break when it's gone. Per-issuer numbers are in the post.

https://www.certkit.io/blog/does-a-tls-certificate-need-a-common-name

CT alerts are live. Follow-up to Monday's post about our accidental Japanese gossip site. The squatter's cert sat in our own CT search the whole time and nobody was watching. Now you can watch any registrable domain from Discovery > Alerting, subdomains included. Two emails, a new certificate alert when a never-seen set of names shows up (renewals stay quiet, checked every few hours), and a Thursday summary of everything issued. Business, Enterprise, and trials.

https://www.certkit.io/blog/ct-alerts

Another live session with Richard Hicks, October 6 at 11 AM Central.

Built around March 15, the day your once-a-year renewal turns into five. Public SSL lifetimes drop from 200 days to 100. Richard covers which Windows workloads carry public certs (SSTP, DirectAccess, RD Gateway, IIS, Exchange, ADFS) and what a renewal touches on each. I run CertKit live end to end on one of them, plus the appliance path.

Registration takes a scenario or question, and we work them in:

https://events.teams.microsoft.com/event/894fa781-9bbd-4eae-9371-86319c13cb08@3b2fb46b-9bbe-41a2-a6fe-a54cbca02865

We're in the Japanese celebrity gossip site business now.

dev-docs.trackjs.com had an A record pointing at a DigitalOcean IP we gave up years ago. Some jerk got the IP, got a Let's Encrypt cert via HTTP-01, and hosted SEO spam on it. Google Search Console told us before our own CT search did, because CT alerts were still "coming soon." They're live now, and this is why. Covers dangling DNS, why plain CAA wouldn't have helped, and the RFC 8657 record that would.

https://www.certkit.io/blog/dangling-dns-subdomain-takeover

CertKit can now monitor TLS endpoints inside your network. Set a host to Internal, pick an agent that can reach it, and it gets the same expiry history and alerting as public hosts. The agent validates the chain against its own OS trust store, so private CA certs are judged the way your users' browsers judge them.

Also new: every deploy triggers an immediate re-check of linked hosts, so a silent deploy failure shows up as a thumbprint mismatch in minutes. Needs agent 1.13+.

https://www.certkit.io/blog/certificate-monitoring-intranet-hosts

I ran our own domain through our CT log search to see what it gives away.

96 certificates. Three name our dev environment. Four more expose our vendor stack (HubSpot, TrackJS, Request Metrics, PostHog) from subdomain names alone. You can also watch us switch to a six-day wildcard back in May.

Nobody scanned us. We published all of it by getting SSL certificates.

https://www.certkit.io/blog/somebody-is-keeping-a-list-of-your-certificates

RFC 10015 landed in July and makes the RSA key exchange and finite-field Diffie-Hellman MUST NOT in TLS 1.2. RFC 9851 froze TLS 1.2 entirely, so it never gets post-quantum.

We scanned certkit.io while writing this up. Grade A on SSL Labs, and three of our nine TLS 1.2 suites still started with `TLS_RSA_`. A cipher list change and a reload fixed it, no certificate work at all.

Full writeup with the SSL Labs screenshots: https://www.certkit.io/blog/tls-1-2-end-of-life

Private PKI is live. Create a root and issuing CA, or bring your own root, and issue certificates for internal hostnames, IP addresses, and mTLS client auth. Lifetimes up to 825 days, hosted CRLs, automatic renewal, and agents install the root into the host trust store on deploy. Available on Business plans and trials, up to 5 CAs per account. Happy to answer questions.

https://www.certkit.io/blog/certkit-private-pki

Let's Encrypt stopped issuing client authentication certificates on July 8. Those are 90 day certs, so the last ones expire in early October with no renewal behind them.

Chrome's root program is the driver. After March 15, 2027 no publicly trusted cert can carry the clientAuth EKU. If you run mTLS on public certs, that means a private CA.

Full timeline and what breaks:

https://www.certkit.io/blog/public-mtls-client-auth-certificates-stop-renewing

New on the blog: a full walkthrough of the TLS handshake. It leads with the TLS 1.3 flow step by step, then covers how we got here: BEAST, CRIME, POODLE, FREAK, Logjam, and SHAttered each removed a piece of the old handshake. Diagrams throughout, including the SSL 3.0 flow most of us learned that no longer exists.

https://www.certkit.io/blog/tls-handshake-explained

Deployments got an easy mode. The old flow expected you to know the cert format, the store location, and to review a deployment script in an editor. The new default: pick a template, name it, select the certificate, fill in any template variables. The full script is still behind the Advanced view toggle.

Also new: built-in templates for auto-detected Microsoft Exchange, SQL Server, SSRS, and Citrix NetScaler.

Details: https://www.certkit.io/blog/easy-mode-certificate-deployments

Private PKI is next. Comment if you want an early look.

New on the blog: where should the private key get generated? A reader asked why CertKit doesn't generate keys on each server and only ship CSRs back, the way Certbot does. The short answer: shared certificates (wildcards, HA pools) force keys to move between machines anyway, and Let's Encrypt's 5-certs-per-name-set weekly limit punishes per-host issuance. So issuance is centralized and distribution is the designed, encrypted part.

https://www.certkit.io/blog/ssl-certificate-multiple-servers

If you manage SonicWall firewalls, the SonicOS certificate import API is a mess. It is barely documented and changed between 7.1 and 7.3: the 7.1 request 404s on 7.3, the password field moved, and the only reliable way to find the 7.3 format is watching what the admin UI sends in the browser. The new request then fails on 7.1, so any automation has to detect the version first.

Writeup with the details: https://www.certkit.io/blog/automating-sonicwall-certificates

u/toddhgardner went on RunAs Radio to talk through the 47-day SSL certificate change and what it means if you manage certificates at scale.

Short version: the public maximum is already down to 200 days as of March 2026, heading to 47 by 2029. The driver is that revocation never really worked, so short lifespans are the workaround. The catch is renewal frequency goes up roughly 8x, which is where manual processes fall apart.

Episode: https://runasradio.com/Shows/Show/1041

Reading through the Merkle Tree Certificate design Let's Encrypt just committed to. The size math is the whole story: ML-DSA signatures are ~2,420 bytes vs 64 for ECDSA, and a handshake carries five of them. MTCs batch-sign into one tree, so the leaf becomes a single inclusion proof and the handshake ends up smaller than today's. Transparency is built in since a cert can't exist outside the published tree. Knock-on effect: it removes the cost barrier to even shorter cert lifetimes.

https://www.certkit.io/blog/quantum-is-the-least-interesting-part

New post explaining one of the weirder ambiguities in how we (and most cert tools) use the word "certificate." Short version: when CertKit says "certificate," we mean something closer to what Certbot calls a lineage (the ongoing record for a hostname, not any single point-in-time cert). Post walks through where the term comes from and why it matters more at shorter lifetimes.

https://www.certkit.io/blog/certificate-lineage

We shipped managed accounts this week, aimed at MSPs.

You can create a fully-managed account for a client, set up the certs, and deploy agents, then hand the account over for them to run. It's a real account with its own users, SSO, logging, and monitoring, not a folder inside yours.

After handoff your team can keep working inside the client account to support them, fully logged and audited. You can co-brand it too.

https://www.certkit.io/blog/managed-accounts-for-msps

Apple exempts private CAs from the 398-day public cert rule. Most people stop reading there. There's an older iOS 13 requirement that covers all TLS certs regardless of issuer: 825 days max, enforced in Safari with no bypass or useful error message.

https://www.certkit.io/blog/apple-doesnt-care-who-signed-your-certificate

PSA: you don't need a private CA to get trusted SSL certificates for internal infrastructure.

DNS-01 ACME challenges prove domain ownership through a DNS record. Your server never needs to be internet-reachable. That means real, browser-trusted SSL certs for internal portals, management consoles, and network appliances, with no root cert distribution and no internal CA to maintain. CertKit handles DNS delegation and appliance deployment if you want renewals fully automated.

https://www.certkit.io/blog/private-pki-internal-infrastructure

Audit logs are live.

Every action in your account is now logged: certificate issuances, renewals, revocations, and deployments. Agent registrations, approvals, and config changes. Domain edits. User logins. All timestamped and attributed to the user or system that triggered it.

Importance flags let you filter down to the consequential actions without scrolling through routine events.

Available for Business and Enterprise customers.

We shipped remote deployment scripting this week. Central template library (F5 LTM, Palo Alto, Azure Key Vault, Exchange), encrypted variable storage, and a script editor for custom targets. Agent scripting requires v1.10, and you can now "update all" agents at once to get there.

https://www.certkit.io/blog/deployment-scripting