5 ms·

Ask HN: How are you preparing for upcoming short-lived SSL renewals?

7 points by froil 1y ago

Any new tools or services or saas you are exploring? Every company have myraid of requirements and stuff. Anyone building new solution?

kbrannigan 1y ago
Any more info regarding that. What does that mean?
- galaxy_gas 1y ago
  As of March 15, 2026, the maximum lifetime for a TLS certificate will be 200 days. As of March 15, 2027, the maximum lifetime for a TLS certificate will be 100 days. As of March 15, 2029, the maximum lifetime for a TLS certificate will be 47 days. As of March 15, 2026, the maximum period during which domain validation information may be reused is 200 days. As of March 15, 2027, the maximum period during which domain validation information may be reused is 100 days. As of March 15, 2029, the maximum period during which domain validation information may be reused is 10 days. https://groups.google.com/a/groups.cabforum.org/g/servercert-wg/c/bvWh5RN6tYI https://groups.google.com/a/groups.cabforum.org/g/servercert...
  - admissionsguy 1y ago
    Wow, I love the vibe the voting by companies give. Could see this kind of governance expand to other areas.
deleted 1y ago
[deleted]
galaxy_gas 1y ago
Already using acme
comprev 1y ago
Not building anything but I'm helping other teams work on their automation to improve rotation processes. A surprising number of Ops colleagues have almost zero exposure to IaC and the short-lived certificates on the horizon has been the necessary catalyst to change this.
- froil 1y ago
  What are you using for automation? Blend of terraform , ansible?
  - comprev 1y ago
    Yes, mostly those two. Many staff didn't know the systems had an API as they don't really have much development experience - just a long career in clickops/Windows. Only now are their roles morphing to include programming and, understandably, it's occasionally a daunting steep learning curve for them.
weddpros 1y ago
I built https://SSLboard.com https://SSLboard.com to manage your certificates at any scale and see what’s deployed, where and how. It’s using Certificate Transparency to inventory your certificates so it requires minimal input but provides a complete audit of deployed certificates. Automation isn't enough: qualys.com (famous for SSLLabs.com) is currently serving an expired certificate (expired 8 days ago). They know their job very well, but without a tool to thoroughly and systematically inventory your certificates, you'll miss it.
- froil 1y ago
  Thanks

7 points by froil 1y ago

Any new tools or services or saas you are exploring? Every company have myraid of requirements and stuff. Anyone building new solution?

kbrannigan 1y ago

Any more info regarding that. What does that mean?

galaxy_gas 1y ago
As of March 15, 2026, the maximum lifetime for a TLS certificate will be 200 days. As of March 15, 2027, the maximum lifetime for a TLS certificate will be 100 days. As of March 15, 2029, the maximum lifetime for a TLS certificate will be 47 days. As of March 15, 2026, the maximum period during which domain validation information may be reused is 200 days. As of March 15, 2027, the maximum period during which domain validation information may be reused is 100 days. As of March 15, 2029, the maximum period during which domain validation information may be reused is 10 days. https://groups.google.com/a/groups.cabforum.org/g/servercert-wg/c/bvWh5RN6tYI https://groups.google.com/a/groups.cabforum.org/g/servercert...
- admissionsguy 1y ago
  Wow, I love the vibe the voting by companies give. Could see this kind of governance expand to other areas.

deleted 1y ago

[deleted]

galaxy_gas 1y ago

Already using acme

comprev 1y ago

Not building anything but I'm helping other teams work on their automation to improve rotation processes. A surprising number of Ops colleagues have almost zero exposure to IaC and the short-lived certificates on the horizon has been the necessary catalyst to change this.

froil 1y ago
What are you using for automation? Blend of terraform , ansible?
- comprev 1y ago
  Yes, mostly those two. Many staff didn't know the systems had an API as they don't really have much development experience - just a long career in clickops/Windows. Only now are their roles morphing to include programming and, understandably, it's occasionally a daunting steep learning curve for them.

weddpros 1y ago

I built https://SSLboard.com https://SSLboard.com to manage your certificates at any scale and see what’s deployed, where and how. It’s using Certificate Transparency to inventory your certificates so it requires minimal input but provides a complete audit of deployed certificates. Automation isn't enough: qualys.com (famous for SSLLabs.com) is currently serving an expired certificate (expired 8 days ago). They know their job very well, but without a tool to thoroughly and systematically inventory your certificates, you'll miss it.

froil 1y ago
Thanks