toddgardner
Joined 13 years ago
Karma
359
Submissions
71
Member since
Dec 10
I start things.
View on Hacker NewsRecent submissions
Comment · 1 day ago
Why would you want something like this? It implies that someone still is looking at certificates and rotating them by hand, which is never going to work for 47-day certificates. I think you should focus on finding an automation system (that also monitors), not just monitoring.
I'm building something that does this, CertKit.io
Comment · 2 months ago
Yikes, not a good look when everyone needs to be automating certificate renewal.
Comment · 4 months ago
OP Here.
What you fail to grasp is that there are multiple sizes of IT organizations on this planet. The vast majority of them have less than 10 total admins. For them, they could not build and maintain an internal PKI thats as secure or as reliable as Public PKI.
Expecting them to do so is giving up. They will just use self-signed certs and blindly click through warnings.
Having a real certificate that warns when something is wrong is always better than perfect security. When you've worked at more than 1 kind of organization, you get a broader perspective.
Comment · 7 months ago
Nice rewrite. The SAN support is the right call, a lot of older generators trip on that.
One thing worth knowing if you're using this for internal services: generating the cert is the easy part. Getting the CA cert into the trust stores of everything that needs to trust it is where self-signed deployments usually turn into a maintenance problem, especially across a mix of Linux servers, Windows machines, and Java apps with their own keystores.
Comment · 7 months ago
I am talking to so many mid-sized IT shops that still have lots of legacy on-prem windows systems or specialty software where Certbot or ACME renewals is hard. This sort of thing gets dismissed as "just use certbot" in threads like these, and its infuriating.
We started building CertKit (https://www.certkit.io/) to centralize ACME for just these sort of things.
Comment · 8 months ago
If you never want this to happen again to your systems, we’re building a tool that bakes monitoring and validation into automatic cert renewals.
Comment · 10 months ago
> What is the problem with stale certificates if a domain changes hands?
The previous owners have valid certificates for up to 398 days. If they are a malicious party cable of doing a man-in-the-middle attack, they can present a valid certificate and fully impersonate the owner. For example, when Stripe started, they purchased the domain from another party, who had a valid stripe.com payment certificate for nearly a year. (https://www.certkit.io/blog/bygonessl-and-the-certificate-th...)
> Is CertKit a similar solution to Anchor Relay?
I hadn't heard about anchor relay before, thanks for the link!
CertKit is similar, but broader. Anchor says it sits between your ACME clients and the CA and simplifies the validation steps, which is super useful. But you still have to run ACME clients and have a bunch of automation logic running on your end.
CertKit IS the ACME client. You CNAME the challenge record to us and we do all the communication with the CAs and store/renew/revoke your certificates centrally. Your systems can pull (or be pushed) the certs they need via our API, then we monitor the HTTPS endpoints to make sure the correct cert is running. Its a fully-audited centralized certificate management.
Comment · 10 months ago
For all the folks worried about how hard automation is going to be, this is what my team and I have been working on for the past year:
https://www.certkit.io/certificate-management
You CNAME the acme challenge DNS to us, we manage all your certificates for you. We expose an API and agents to push certificates everywhere you need them, and then do real-time monitoring that the correct certificate is running on the webserver. End-to-end auditability.
Comment · 10 months ago
It's not really a stupid problem, its the BygoneSSL problem:
https://www.certkit.io/blog/bygonessl-and-the-certificate-th...