https://automate-certificates.com/blog/ TLS certificate discovery, renewal, and deployment — practical notes for platform and security teams. en Thu, 16 Jul 2026 00:00:00 GMT https://automate-certificates.com/blog/automated-certificate-discovery/ https://automate-certificates.com/blog/automated-certificate-discovery/ Thu, 16 Jul 2026 00:00:00 GMT Every certificate incident starts the same way: someone asks which team owns the cert, and nobody can find it in the spreadsheet. Discovery is not a one-time CMDB project. Hostnames move, SANs get added at the load balancer, acquisitions import unknown CAs, and shadow issuance shows up in Certificate Transparency before your inventory does. Automated discovery means running complementary methods on a schedule — not exporting certmgr once a year. https://automate-certificates.com/blog/gpo-certificate-autoenrollment-and-where-it-stops/ https://automate-certificates.com/blog/gpo-certificate-autoenrollment-and-where-it-stops/ Thu, 16 Jul 2026 00:00:00 GMT Active Directory Certificate Services (AD CS) plus Group Policy auto-enrollment is how many Windows estates have handled internal certificates for years. It works well inside its boundary — and quietly stops at the edge of that boundary. Teams that treat GPO enrollment as estate-wide PKI often discover gaps only when a Linux load balancer expires or a cloud PaaS endpoint was never in scope. https://automate-certificates.com/blog/ssl-certificate-expiry-alerts-that-work/ https://automate-certificates.com/blog/ssl-certificate-expiry-alerts-that-work/ Thu, 16 Jul 2026 00:00:00 GMT The spreadsheet and shared calendar worked when one team owned a dozen hostnames and certificates lasted a year. It fails quietly at scale. Ownership churn leaves rows with ex-employees still listed as contacts. New certificates never get a row because issuance happened in a cloud console, not through the process that fed the sheet. Renewal in a vault is not deployment to the listener — and nobody updates the calendar when the VIP still serves the old serial. https://automate-certificates.com/blog/what-automated-certificate-management-covers/ https://automate-certificates.com/blog/what-automated-certificate-management-covers/ Thu, 16 Jul 2026 00:00:00 GMT Automated certificate management is not a single integration with a public CA. It is a pipeline across six stages — and most partial solutions stop after one or two. Buying issuance automation without discovery leaves shadow certs untracked. Issuing without deployment leaves fresh PEM files in a vault while customers hit the old chain. Understanding the full scope keeps you from paying for a tool that solves the easy third of the problem. https://automate-certificates.com/blog/lets-encrypt-90-day-renewal-runbook/ https://automate-certificates.com/blog/lets-encrypt-90-day-renewal-runbook/ Fri, 12 Jun 2026 00:00:00 GMT Let's Encrypt certificates expire in 90 days. That is not a surprise — it is the operating model. What breaks teams is treating renewal like a one-time setup task instead of a recurring production workflow with staging, monitoring, and deployment hooks. https://automate-certificates.com/blog/kubernetes-tls-before-cert-manager/ https://automate-certificates.com/blog/kubernetes-tls-before-cert-manager/ Thu, 11 Jun 2026 00:00:00 GMT cert-manager solved certificate issuance for many clusters. It did not solve inventory, cross-cluster deployment, or the gap between a ready Certificate resource and a pod that serves the new chain. Teams that install cert-manager and close the ticket still page on expiry — because the operational model stopped at the CRD. https://automate-certificates.com/blog/azure-key-vault-vs-acme-automation/ https://automate-certificates.com/blog/azure-key-vault-vs-acme-automation/ Wed, 10 Jun 2026 00:00:00 GMT Azure Key Vault is the default home for TLS material in Microsoft-centric estates. App Service, Application Gateway, and AKS integrations all point at vault certificates. The question is not whether to use Key Vault — it is whether renewal happens through Azure-managed issuance, manual import, or ACME automation that writes new versions on a schedule. https://automate-certificates.com/blog/certificate-expiry-incident-cost/ https://automate-certificates.com/blog/certificate-expiry-incident-cost/ Tue, 09 Jun 2026 00:00:00 GMT Certificate expiry outages look cheap until you add up customer-visible downtime, senior engineer hours, vendor escalations, and the compliance finding that lands six weeks later. Finance teams budget for CA fees and HSM slots — not for the Sunday when API clients silently fail TLS handshake validation across three regions. https://automate-certificates.com/blog/dns-01-vs-http-01-acme/ https://automate-certificates.com/blog/dns-01-vs-http-01-acme/ Mon, 08 Jun 2026 00:00:00 GMT Every ACME integration chooses HTTP-01 or DNS-01 first — and often never revisits the decision. HTTP-01 is simpler on paper. DNS-01 scales to wildcards and split-horizon DNS. The wrong choice shows up as intermittent renewal failures that correlate with TTL, CDN caching, or firewall rules nobody documented. https://automate-certificates.com/blog/code-signing-cert-lifecycle/ https://automate-certificates.com/blog/code-signing-cert-lifecycle/ Sun, 07 Jun 2026 00:00:00 GMT TLS automation matured faster than code signing governance. Platform teams renew Let's Encrypt certs on cron while the EV code signing token still lives in one engineer's drawer with a calendar reminder. The lifecycle extends from CSR generation through timestamping, revocation, and audit evidence — most of which never appears in a CI YAML file. https://automate-certificates.com/blog/post-quantum-crypto-agility-no-inventory/ https://automate-certificates.com/blog/post-quantum-crypto-agility-no-inventory/ Tue, 03 Mar 2026 00:00:00 GMT Every post-quantum briefing points the same way: a cryptographically relevant quantum computer is years out, the NSA's CNSA 2.0 timeline doesn't force full migration until 2035, and there are louder fires this quarter. So PQC gets filed as research, something to revisit when the hardware threat is closer. That filing confuses the easy part of the problem with the hard part. https://automate-certificates.com/blog/iot-embedded-device-certs-cant-renew-remotely/ https://automate-certificates.com/blog/iot-embedded-device-certs-cant-renew-remotely/ Fri, 13 Feb 2026 00:00:00 GMT A device sits in a substation cabinet, or bolted to a rooftop HVAC unit, holding a client certificate burned in on the factory line. Ten-year validity, no renewal service, no plan for re-enrollment. Not a lazy call: long lifetimes mean fewer moving parts, and nobody wants a field meter phoning home just to stay alive. https://automate-certificates.com/blog/merger-acquired-estate-unknown-certificates/ https://automate-certificates.com/blog/merger-acquired-estate-unknown-certificates/ Thu, 22 Jan 2026 00:00:00 GMT The integration lead gets a mandate that reads like a network diagram: merge the directories, route the traffic, fold the apps under one domain, kill the duplicate VPN. The trap is the word "merge." You can merge a network in a quarter. You cannot merge a certificate estate you have never seen, and the acquired company shipped its entire PKI to you the day the deal closed: every internal CA, every wildcard, every self-signed cert on a host older than anyone still on payroll. https://automate-certificates.com/blog/lets-encrypt-rate-limit-mass-reissue-day/ https://automate-certificates.com/blog/lets-encrypt-rate-limit-mass-reissue-day/ Thu, 01 Jan 2026 00:00:00 GMT Ask whoever signs off on the DR runbook how long it takes to re-issue every certificate you own, and you usually get a shrug: automation renews them, so re-issuing the lot must be the same job aimed at every host at once. That instinct fails under load. Day-to-day renewal is a slow trickle the CA has sized its limits for; mass re-issuance is a spike, and refusing spikes is part of what a CA does. You never notice the gap until something rips the schedule from your hands: a CA distrust, a compromised key, a forced migration off a vendor. Suddenly you need thousands of fresh certificates today, and a rate limit nobody ever measured governs the whole incident. https://automate-certificates.com/blog/monitoring-tool-cert-its-own-cert-expired/ https://automate-certificates.com/blog/monitoring-tool-cert-its-own-cert-expired/ Wed, 10 Dec 2025 00:00:00 GMT You run reliability. You built the cert dashboard, wired the 30-day and 7-day expiry alerts, and you sleep because the system tells you before anything breaks. The bad assumption is buried in that last word. Your inventory covers the application certs, not the certs underneath the thing doing the watching. The ones that take you down sit on the boxes between your check and your phone. https://automate-certificates.com/blog/pci-dss-4-strong-cryptography-cert-inventory/ https://automate-certificates.com/blog/pci-dss-4-strong-cryptography-cert-inventory/ Wed, 19 Nov 2025 00:00:00 GMT Three clean PCI assessments in a row teach a compliance director that the next one is a re-run: same scope, same evidence, new clause numbers. So the 4.0 cycle gets booked like routine maintenance. That booking is the mistake. The future-dated requirements went live on 31 March 2025, and two of them ask for an artifact your cardholder data environment has almost certainly never produced as a standing record: an inventory of the keys, certificates, cipher suites, and protocols protecting account data. https://automate-certificates.com/blog/key-vault-expiry-no-alert-silent-expiry/ https://automate-certificates.com/blog/key-vault-expiry-no-alert-silent-expiry/ Tue, 28 Oct 2025 00:00:00 GMT The cloud platform lead stood up Key Vault, set RBAC tight, imported the wildcard, and ticked "certificates" off the platform checklist. The mental model was simple: it lives in the vault, the vault is managed, so the certificate is managed. Eleven months later the Application Gateway started serving an expired cert, and the on-call heard about it from a customer instead of from an alert. https://automate-certificates.com/blog/internal-pki-mtls-no-rotation-microservices/ https://automate-certificates.com/blog/internal-pki-mtls-no-rotation-microservices/ Tue, 07 Oct 2025 00:00:00 GMT A platform director greenlights internal mTLS because security asked for it and the service mesh made it a checkbox. Istio or Linkerd mints a root, every sidecar gets a leaf, traffic is encrypted and authenticated by the next sprint. The wrong assumption: the part the mesh automated is not the part that will hurt you. Leaf certs rotate themselves on a tight cycle and you forget them. The root that signs the chain does not rotate itself, and it carries an expiry date you picked once, distractedly, in a Helm value. https://automate-certificates.com/blog/dns-provider-outage-blocks-dns-01-renewal/ https://automate-certificates.com/blog/dns-provider-outage-blocks-dns-01-renewal/ Mon, 15 Sep 2025 00:00:00 GMT You picked DNS-01 for the right reasons. It does wildcards, it works for hosts that never touch the public internet, and you don't have to punch port 80 through a load balancer to satisfy a CA. The platform team wired the provider plugin into the ACME client, watched a few issuances go green, and moved on. https://automate-certificates.com/blog/offboarding-engineer-owned-the-acme-account/ https://automate-certificates.com/blog/offboarding-engineer-owned-the-acme-account/ Wed, 27 Aug 2025 00:00:00 GMT Offboarding goes by the book. You revoke the departing engineer's SSO, rotate their cloud keys, take back the laptop, sign the ticket. Clean exit. What hides in the word "clean" is the assumption that nothing load-bearing was still running as that person. Certificate renewal usually is, because someone wired it up in an afternoon two years ago, it never broke, and so nobody ever touched it again. https://automate-certificates.com/blog/iso-27001-annex-a-cryptography-evidence-gap/ https://automate-certificates.com/blog/iso-27001-annex-a-cryptography-evidence-gap/ Tue, 05 Aug 2025 00:00:00 GMT The compliance owner walks into the surveillance audit holding a four-page Cryptography Policy that survived the last certification cycle untouched. It says the right things: TLS 1.2 minimum, RSA-2048 or P-256, keys rotated annually, certificates from an approved CA. The quiet assumption in that binder is that the document is the control. It isn't, and the auditor is about to show why. https://automate-certificates.com/blog/lost-deal-vendor-security-questionnaire-pki/ https://automate-certificates.com/blog/lost-deal-vendor-security-questionnaire-pki/ Thu, 17 Jul 2025 00:00:00 GMT If you run security at a company that sells into the enterprise, your job has quietly split in two. Half is defending your own perimeter. The other half, the part nobody put in a budget, is proving to someone else's third-party risk team that the perimeter is real. Certificate lifecycle lives entirely in that second half, which is exactly why it stays underfunded. No internal user files a ticket when the inventory is a spreadsheet. The pain surfaces later, in a stranger's questionnaire, attached to a deal you meant to close this quarter. https://automate-certificates.com/blog/wildcard-sprawl-one-key-many-hosts/ https://automate-certificates.com/blog/wildcard-sprawl-one-key-many-hosts/ Wed, 25 Jun 2025 00:00:00 GMT A platform director opens a certificate inventory with eighty rows and decides the inventory itself is the problem. The fix looks obvious: buy one *.corp.example.com wildcard, push it everywhere, watch the count drop from eighty to one. Fewer renewals, fewer expiry alerts, fewer rows to babysit. The plan rests on one belief, that the count was ever the hard part. https://automate-certificates.com/blog/expired-intermediate-chain-leaf-still-valid/ https://automate-certificates.com/blog/expired-intermediate-chain-leaf-still-valid/ Wed, 04 Jun 2025 00:00:00 GMT You built the cert monitoring, and it is good. It pages on not_after, watches every public hostname, and has caught real renewals before they lapsed. But one assumption baked into it eventually bites: that a valid leaf means a valid connection. The leaf is the only object you inventory, so the leaf is the only thing your alerting can see expire. https://automate-certificates.com/blog/code-signing-key-never-rotated-lapsus-nvidia/ https://automate-certificates.com/blog/code-signing-key-never-rotated-lapsus-nvidia/ Wed, 14 May 2025 00:00:00 GMT Ask the head of engineering when your code-signing key was last rotated. Usually you get a pause, then a guess. It was minted years ago, it lives in a build server's certificate store or on someone's laptop, and nobody touches it because the last attempt threw trust warnings and slipped a release. The wrong assumption underneath all of that: a code-signing certificate is something you configure once. It is not. It is a standing authorization to ship software under your company's name, and it stays dangerous long after it stops looking active. https://automate-certificates.com/blog/expiry-outage-cost-3-million-not-budgeted/ https://automate-certificates.com/blog/expiry-outage-cost-3-million-not-budgeted/ Tue, 22 Apr 2025 00:00:00 GMT Ask a reliability manager what a cert outage costs and you often get a single number: thirty minutes. Swap the cert, bounce the service, write the postmortem over coffee. That number is why certificate expiry never gets monitoring, never gets a named owner, and never lands in a capacity plan. It sits in the same mental bucket as a stuck cron job. https://automate-certificates.com/blog/ca-distrust-entrust-replacement-fire-drill/ https://automate-certificates.com/blog/ca-distrust-entrust-replacement-fire-drill/ Thu, 03 Apr 2025 00:00:00 GMT Years ago your head of engineering picked a CA, wired it into the renewal tooling, and crossed it off the list. Ever since, the certificate has been treated like a power feed: permanent infrastructure nobody re-evaluates. The assumption buried in that choice is that the issuer stays trusted as long as the invoices get paid. That is not your decision to make. The browser root programs make it, and they can pull trust without asking you. https://automate-certificates.com/blog/shadow-certificates-ct-logs-auditor-finds/ https://automate-certificates.com/blog/shadow-certificates-ct-logs-auditor-finds/ Mon, 17 Mar 2025 00:00:00 GMT Most platform teams treat the provisioning pipeline as the registry of truth. If a certificate exists, the pipeline issued it, logged it, and tagged it to an owner. That belief holds right up until someone runs a crt.sh query against the corporate apex and gets back forty hostnames nobody on the call recognizes. https://automate-certificates.com/blog/47-day-certificates-manual-renewal-cliff/ https://automate-certificates.com/blog/47-day-certificates-manual-renewal-cliff/ Sun, 23 Feb 2025 00:00:00 GMT A platform director sees 47 days next to a 2029 date and files it under "plenty of runway." The number that should worry them is not 47. It is 200, and it arrives in March 2026. The phase-in puts the friendly-sounding figure at the end, which buries the year your manual process actually starts to crack. https://automate-certificates.com/blog/certificate-register-dora-article-7-empty/ https://automate-certificates.com/blog/certificate-register-dora-article-7-empty/ Tue, 04 Feb 2025 00:00:00 GMT A CISO at a regulated financial entity reads DORA RTS Article 7, sees the phrase "register of all certificates," and quietly checks the box. There is a CMDB. There is a spreadsheet the platform team keeps. There is the DigiCert or Sectigo portal listing everything issued through the corporate account. One of those, the thinking goes, already is the register.