|
By Todd H. Gardner
Getting a certificate from a CA is a solved problem (ACME). Distributing it to the rest of your infrastructure is not. Your F5 has its own API. Your Palo Alto has a different one. Azure Key Vault is a third thing entirely, and the appliance in the back of the rack only has an SSH interface.
|
By Todd H. Gardner
I’m an old engineer at heart. Many of my ideals were formed by Joel’s Things You Should Never Do, Fred’s No Silver Bullet, and Brian’s Big Ball of Mud. One of my favorites was Greenspun’s Tenth Rule: The joke isn’t really about programming languages. It’s about a pattern: certain problems have a shape, and no matter how you approach them, you end up building the same solution, in the same order, until you arrive at the same messy place.
|
By Todd H. Gardner
A few practical improvements this week, mostly driven by what we’re learning as customers deploy CertKit into larger infrastructures.
|
By Todd H. Gardner
Two big things in this release, a remote-updating CertKit agent Google Trust Store CA issuer support.
|
By Todd H. Gardner
In preparation for launching CertKit last week, I browsed the websites of a lot of related cybersecurity services. I don’t really understand what any of them do, but apparently, “trust” is a thing that can be sold now.
|
By Todd H. Gardner
CertKit is officially out of beta. We started building CertKit a year ago, and since then over 600 people signed up, issued certificates, and deployed to their infrastructure. Several are running it as their production certificate management platform right now. We built a lot during the beta. Some of it we planned: SSO, team management, alerting. Other things, users had to beat into us. The Keystore came from enterprise security requirements to keep private keys in house.
|
By Todd H. Gardner
We release some good stuff this week with the CertKit agent version 1.8 from our roadmap, along with some small usability fixes in the CertKit web application.
|
By Todd H. Gardner
On March 19th, Richard Hicks, one of our customers, emailed us about a certificate that had renewed after only a week. It was a 90-day certificate and he had not initiated the renewal. That’s the kind of thing that sends you straight to the logs. We found the answer right away. The certificate’s ARI renewal window had been shortened dramatically.
|
By Todd H. Gardner
When you use CertKit, your private keys live in CertKit’s database, encrypted at rest. We’ve written about why the actual risk is smaller than it sounds. But some organizations have policies that prohibit storing private keys with any third party, regardless of how they’re protected. That policy isn’t going away. The Local Keystore enables those organizations to use CertKit and still keep their keys local.
|
By Todd H. Gardner
Certbot is good software in the classic Linux tradition: it does one thing simply and expects you to chain it together with everything else. One server, one certificate, done. The trouble is that most environments are not simple. And the moment yours isn’t, you discover that renewing a certificate and getting it deployed are two different problems, and deployment is your problem.
- May 2026 (1)
- April 2026 (6)
- March 2026 (8)
- February 2026 (6)
- January 2026 (6)
- December 2025 (4)
- November 2025 (5)
- October 2025 (2)
- September 2025 (2)
Finally, a GUI for certificate management. No more checking if CertBot actually ran. CertKit gives you one dashboard to see every cert, every renewal, every domain—before they expire and ruin your weekend. Built after the third production outage from a failed ACME challenge that nobody noticed.
Just point a DNS CName at us, and we'll automatically discover, provisioning, validation, renewal, and deployment of certificates. Through an actual UI that can be easily monitored. Supports wildcards, multi-domain, whatever complexity you've accumulated over the years. No DNS API keys to leak. No cron jobs to debug. No Kubernetes required.
Built by the TrackJS team who are known for building simple and reliable tools that Just Work™️.