Resource Library

SSL certificates expire to enhance security, comply with evolving regulations, and encourage timely updates. Shorter validity periods, soon to be 47 days, improve cybersecurity by...

Apple has announced it will support Merkle Tree Certificates for PQC and has released a draft root store policy. We share some of the surprising requirements in this draft.

As certificate lifespans become extremely short, new methods of delivery become functionally necessary. We explain RFC 9345 and how delegated credentials play a role in CDNs to deliver very short-lived certificates.

With certificate lifespans shortening, we occasionally run into those who disagree with this trend and seek to lengthen maximum term once again.  We examine regressive attitudes in PKI, why they occur, and the reasons that lessening security is generally a bad policy.

X9 is a consortium certificate for interbanking applications. There is a common misunderstanding that X9 certificates are a public-trust surrogate for mTLS using WebPKI certificates.  We clarify why this is not the case.

There is no CABF or root program rule preventing public CAs from implementing new requirements earlier than their assigned due dates. We discuss reasons to implement a rule early and how early it should be.

SSL hasn't been a standard in use for nearly thirty years, but we still use the word. We discuss why that is, what else we might say, and the expected effect of Merkle Tree Certificates (MTC) on our technical vocabulary.

With the upcoming deprecation of client authentication using publicly trusted TLS certificates, we go over the common use cases for these certificates. We discuss the reasons public trust is often chosen and how to transition away from it.

Because of a change in the drop-dead date, we have observed confusion about the timeline for deprecation of client authentication and mTLS for public TLS certificates. This is an inflexible deadline, and enterprises that are not ready risk outage. In this episode we spell out these dates very clearly.

Recent and impending contractions in the validity periods of publicly trusted Transport Layer Security (TLS) certificates have significantly elevated the risk of enterprise web service outages.

2024 saw a flurry of high profile incidents for public CA, which we named the Bugzilla Bloodbath. We look back to see how the WebPKI has changed as a consequence.