Recursos

Bugzilla Bloodbath Redux: 138 open bugs, mostly third-party reported. Tim and Jason explain the AI-driven surge.

Los certificados SSL caducan para reforzar la seguridad, cumplir con la normativa en constante evolución y fomentar las actualizaciones oportunas. Los periodos de validez más cortos, que pronto pasarán a ser de 47 días, mejoran la ciberseguridad al...

La automatización de las renovaciones de certificados SSL es esencial para que las empresas de cualquier tamaño eviten interrupciones del servicio y los riesgos de seguridad asociados..

Apple has announced it will support Merkle Tree Certificates for PQC and has released a draft root store policy. We share some of the surprising requirements in this draft.

Publicly trusted client authentication certificates have a hard deadline to be deprecated in Q1 2027. Not everyone is ready for that. We discuss some of the reasons why and what to do about it.

As certificate lifespans become extremely short, new methods of delivery become functionally necessary. We explain RFC 9345 and how delegated credentials play a role in CDNs to deliver very short-lived certificates.

With certificate lifespans shortening, we occasionally run into those who disagree with this trend and seek to lengthen maximum term once again.  We examine regressive attitudes in PKI, why they occur, and the reasons that lessening security is generally a bad policy.

X9 is a consortium certificate for interbanking applications. There is a common misunderstanding that X9 certificates are a public-trust surrogate for mTLS using WebPKI certificates.  We clarify why this is not the case.

There is no CABF or root program rule preventing public CAs from implementing new requirements earlier than their assigned due dates. We discuss reasons to implement a rule early and how early it should be.

SSL hasn't been a standard in use for nearly thirty years, but we still use the word. We discuss why that is, what else we might say, and the expected effect of Merkle Tree Certificates (MTC) on our technical vocabulary.

With the upcoming deprecation of client authentication using publicly trusted TLS certificates, we go over the common use cases for these certificates. We discuss the reasons public trust is often chosen and how to transition away from it.

Because of a change in the drop-dead date, we have observed confusion about the timeline for deprecation of client authentication and mTLS for public TLS certificates. This is an inflexible deadline, and enterprises that are not ready risk outage. In this episode we spell out these dates very clearly.

2024 saw a flurry of high profile incidents for public CA, which we named the Bugzilla Bloodbath. We look back to see how the WebPKI has changed as a consequence.

TLS 1.3 is required to take advantage of post quantum cryptography (PQC) algorithms. Yes, we still see a lot of TLS 1.2 or earlier in deployment. We examine why this is the case and what to do about it.