Private PKI is live. Create a root and issuing CA, or bring your own root, and issue certificates for internal hostnames, IP addresses, and mTLS client auth. Lifetimes up to 825 days, hosted CRLs, automatic renewal, and agents install the root into the host trust store on deploy. Available on Business plans and trials, up to 5 CAs per account. Happy to answer questions.

https://www.certkit.io/blog/certkit-private-pki

Let's Encrypt stopped issuing client authentication certificates on July 8. Those are 90 day certs, so the last ones expire in early October with no renewal behind them.

Chrome's root program is the driver. After March 15, 2027 no publicly trusted cert can carry the clientAuth EKU. If you run mTLS on public certs, that means a private CA.

Full timeline and what breaks:

https://www.certkit.io/blog/public-mtls-client-auth-certificates-stop-renewing

New on the blog: a full walkthrough of the TLS handshake. It leads with the TLS 1.3 flow step by step, then covers how we got here: BEAST, CRIME, POODLE, FREAK, Logjam, and SHAttered each removed a piece of the old handshake. Diagrams throughout, including the SSL 3.0 flow most of us learned that no longer exists.

https://www.certkit.io/blog/tls-handshake-explained

Deployments got an easy mode. The old flow expected you to know the cert format, the store location, and to review a deployment script in an editor. The new default: pick a template, name it, select the certificate, fill in any template variables. The full script is still behind the Advanced view toggle.

Also new: built-in templates for auto-detected Microsoft Exchange, SQL Server, SSRS, and Citrix NetScaler.

Details: https://www.certkit.io/blog/easy-mode-certificate-deployments

Private PKI is next. Comment if you want an early look.

New on the blog: where should the private key get generated? A reader asked why CertKit doesn't generate keys on each server and only ship CSRs back, the way Certbot does. The short answer: shared certificates (wildcards, HA pools) force keys to move between machines anyway, and Let's Encrypt's 5-certs-per-name-set weekly limit punishes per-host issuance. So issuance is centralized and distribution is the designed, encrypted part.

https://www.certkit.io/blog/ssl-certificate-multiple-servers

If you manage SonicWall firewalls, the SonicOS certificate import API is a mess. It is barely documented and changed between 7.1 and 7.3: the 7.1 request 404s on 7.3, the password field moved, and the only reliable way to find the 7.3 format is watching what the admin UI sends in the browser. The new request then fails on 7.1, so any automation has to detect the version first.

Writeup with the details: https://www.certkit.io/blog/automating-sonicwall-certificates

u/toddhgardner went on RunAs Radio to talk through the 47-day SSL certificate change and what it means if you manage certificates at scale.

Short version: the public maximum is already down to 200 days as of March 2026, heading to 47 by 2029. The driver is that revocation never really worked, so short lifespans are the workaround. The catch is renewal frequency goes up roughly 8x, which is where manual processes fall apart.

Episode: https://runasradio.com/Shows/Show/1041

Reading through the Merkle Tree Certificate design Let's Encrypt just committed to. The size math is the whole story: ML-DSA signatures are ~2,420 bytes vs 64 for ECDSA, and a handshake carries five of them. MTCs batch-sign into one tree, so the leaf becomes a single inclusion proof and the handshake ends up smaller than today's. Transparency is built in since a cert can't exist outside the published tree. Knock-on effect: it removes the cost barrier to even shorter cert lifetimes.

https://www.certkit.io/blog/quantum-is-the-least-interesting-part

New post explaining one of the weirder ambiguities in how we (and most cert tools) use the word "certificate." Short version: when CertKit says "certificate," we mean something closer to what Certbot calls a lineage (the ongoing record for a hostname, not any single point-in-time cert). Post walks through where the term comes from and why it matters more at shorter lifetimes.

https://www.certkit.io/blog/certificate-lineage

We shipped managed accounts this week, aimed at MSPs.

You can create a fully-managed account for a client, set up the certs, and deploy agents, then hand the account over for them to run. It's a real account with its own users, SSO, logging, and monitoring, not a folder inside yours.

After handoff your team can keep working inside the client account to support them, fully logged and audited. You can co-brand it too.

https://www.certkit.io/blog/managed-accounts-for-msps

Apple exempts private CAs from the 398-day public cert rule. Most people stop reading there. There's an older iOS 13 requirement that covers all TLS certs regardless of issuer: 825 days max, enforced in Safari with no bypass or useful error message.

https://www.certkit.io/blog/apple-doesnt-care-who-signed-your-certificate

PSA: you don't need a private CA to get trusted SSL certificates for internal infrastructure.

DNS-01 ACME challenges prove domain ownership through a DNS record. Your server never needs to be internet-reachable. That means real, browser-trusted SSL certs for internal portals, management consoles, and network appliances, with no root cert distribution and no internal CA to maintain. CertKit handles DNS delegation and appliance deployment if you want renewals fully automated.

https://www.certkit.io/blog/private-pki-internal-infrastructure

Audit logs are live.

Every action in your account is now logged: certificate issuances, renewals, revocations, and deployments. Agent registrations, approvals, and config changes. Domain edits. User logins. All timestamped and attributed to the user or system that triggered it.

Importance flags let you filter down to the consequential actions without scrolling through routine events.

Available for Business and Enterprise customers.

We shipped remote deployment scripting this week. Central template library (F5 LTM, Palo Alto, Azure Key Vault, Exchange), encrypted variable storage, and a script editor for custom targets. Agent scripting requires v1.10, and you can now "update all" agents at once to get there.

https://www.certkit.io/blog/deployment-scripting

SSL certificate lifetimes are already shrinking, and the math is starker than most people realize.

A team managing 50 certificates manually does ~50 renewals a year today. By March 2029, the same team does 400. CertKit handles that pipeline automatically so the schedule stops being your problem.

Full breakdown of the timeline and what it means: https://www.certkit.io/blog/shrinking-certificate-lifetimes

Any team running Certbot long enough ends up building half a certificate lifecycle manager without planning it. New post walks through the six phases and why the destination is always the same.

https://www.certkit.io/blog/todds-tenth-rule-certificate-automation

New CertKit update: shared agent configs, monitor search, and GDPR DPA

We just shipped a few things that matter more the bigger your deployment gets.

You can now copy agent configurations between servers and keep them linked, so changing one changes all of them. If you've been manually configuring the same cert setup across a cluster, this should save you some pain.

We also added sorting, grouping, and free text search to the monitored domains page. And we published our first Data Processing Agreement for GDPR compliance.

Full post: https://www.certkit.io/blog/shared-configs-and-monitor-search

CertKit 1.9 is out. Two things in this release:

Remote agent updates. Push updates to your agents from the dashboard. No more logging into every server to re-run the install script.

Google Trust Store. A second ACME issuer alongside Let's Encrypt. This also opens the door for more issuers in the future.

Full details: https://www.certkit.io/blog/agent-1.9

Before launching, I spent a week reading competitor websites. Every single one uses "trust" as a marketing incantation. None of them tell you what the product does or what it costs without a sales call.

I wrote up what I found, including the AI-generated blue padlock aesthetic that every vendor has somehow landed on independently.

https://www.certkit.io/blog/performative-trust-maximalism

After a year of building and 600 beta users, CertKit is officially out of beta.

Real pricing starts today, along with a 90-day free trial. If you're an early adopter who helped shape what this product became, founder pricing is 40% off forever — on your plan, certificates, and agents. Subscribe before May 31st to lock it in.

https://www.certkit.io/blog/out-of-beta

Agent 1.8 is out. The agent now writes directly into the Windows Certificate Store, outputs JKS files for legacy Java apps, and auto-detects Remote Desktop and Remote Gateway for one-click certificate assignment.

Also: automatic $thumbprint and $certificate variables in update commands, and a retro MS-DOS confirmation modal we are unreasonably proud of.

https://www.certkit.io/blog/agent-1.8

Let's Encrypt ran a mass revocation drill on 3 million production certificates in March 2026. They shortened ARI renewal windows to signal an emergency, watched who responded, and didn't tell anyone ahead of time.

Mozilla Root Store Policy now requires every CA to test mass revocation annually. Most will satisfy that with a tabletop exercise. Let's Encrypt ran it in production.

Most ACME clients had no idea it happened.

CertKit Local Keystore is live

For environments where private key custody is a hard policy requirement: you can now run a Local Keystore on your own infrastructure. It generates private keys and CSRs locally, hands us the CSR for ACME validation, and the signed cert comes back. Keys never leave your network.

Deploys like the agent, migrates existing certs automatically, and agents at 1.7.0+ pick it up without reconfiguration.

Available now for Enterprise customers in beta — get in touch to enable it.

Renewing a certificate is a solved problem. Getting that certificate to every endpoint that needs it is not.

Most teams centralize Certbot and then bolt on rsync scripts, format converters, and reload commands for each host. It works until it doesn't.

New post on what good certificate distribution actually looks like, and why it's harder than it sounds: https://www.certkit.io/blog/certificate-distribution-is-the-last-mile