Ressourcen

SSL-Zertifikate verfallen, um die Sicherheit zu erhöhen, sich ändernde Vorschriften einzuhalten und rechtzeitige Aktualisierungen zu fördern. Kürzere Gültigkeitsdauer – die bald auf 47 Tage reduziert wird – verbessern die Cybersicherheit, indem sie...

Die Automatisierung der Verlängerung von SSL-Zertifikaten ist für Unternehmen jeder Größe unerlässlich, um Ausfälle und Sicherheitsrisiken...

Apple has announced it will support Merkle Tree Certificates for PQC and has released a draft root store policy. We share some of the surprising requirements in this draft.

As certificate lifespans become extremely short, new methods of delivery become functionally necessary. We explain RFC 9345 and how delegated credentials play a role in CDNs to deliver very short-lived certificates.

With certificate lifespans shortening, we occasionally run into those who disagree with this trend and seek to lengthen maximum term once again.  We examine regressive attitudes in PKI, why they occur, and the reasons that lessening security is generally a bad policy.

X9 is a consortium certificate for interbanking applications. There is a common misunderstanding that X9 certificates are a public-trust surrogate for mTLS using WebPKI certificates.  We clarify why this is not the case.

There is no CABF or root program rule preventing public CAs from implementing new requirements earlier than their assigned due dates. We discuss reasons to implement a rule early and how early it should be.

SSL hasn't been a standard in use for nearly thirty years, but we still use the word. We discuss why that is, what else we might say, and the expected effect of Merkle Tree Certificates (MTC) on our technical vocabulary.

With the upcoming deprecation of client authentication using publicly trusted TLS certificates, we go over the common use cases for these certificates. We discuss the reasons public trust is often chosen and how to transition away from it.

Because of a change in the drop-dead date, we have observed confusion about the timeline for deprecation of client authentication and mTLS for public TLS certificates. This is an inflexible deadline, and enterprises that are not ready risk outage. In this episode we spell out these dates very clearly.

2024 saw a flurry of high profile incidents for public CA, which we named the Bugzilla Bloodbath. We look back to see how the WebPKI has changed as a consequence.

TLS 1.3 is required to take advantage of post quantum cryptography (PQC) algorithms. Yes, we still see a lot of TLS 1.2 or earlier in deployment. We examine why this is the case and what to do about it.

EV-SSL-Zertifikate nutzen bewährte, äußerst vertrauenswürdige Authentifizierungsmethoden, um die bestmögliche Gewähr für die Legitimität einer Website zu bieten.