certkit

Heads up if you're planning to automate Exchange certs with Let's Encrypt's newer profiles (tlsserver, shortlived). They issue certs with an empty Subject, no CN at all. Connectors that use `TlsCertificateName` reference the cert as `<I>Issuer<S>Subject`, so the value changes even when the SANs are identical. The default classic profile still includes the CN. Wrote up the other software we've seen trip on this.

https://www.certkit.io/blog/does-a-tls-certificate-need-a-common-name

The 7-day cap is getting the attention, but the operator requirements are the interesting part.

Three cosignatures per cert: ML-DSA-44 and ECDSA-P256 from the issuing operator, plus ML-DSA from a different operator acting as a mirror. Every MTC carries an attestation from a competitor.

Then FIPS 140-3 L3 or EAL4+ for cosigner keys, IANA PENs behind trust anchor IDs, annual audit, and a published record for every domain validation.

Curious what people make of the mirror requirement.