160
Comodo Attempting to Register Let’s Encrypt Trademarks
letsencrypt.org//2016/06/23/defending-our-bra...111
certctl — self-hosted certificate lifecycle platform with Local CA, ACME v2, automated renewal, and deployment
reddit.com/gallery/1rxnkik
reddit.com107
Godaddy has issued at least 8850 SSL certificates without validating anything
groups.google.com/forum/?hl=en#!msg/mozilla.d...102
certctl V2 — self-hosted PKI lifecycle platform: DER CRL + embedded OCSP, ACME DNS-01 wildcards, step-ca, sub-CA chains, CIDR network scanning, RFC 5280 revocation
reddit.com/gallery/1s3h81y
reddit.com816
Why Chrome 53 is Rejecting Chase Bank's Symantec Certificate
sslmate.com/blog/post/ct_redaction_in_chrome_53
sslmate.com82
Google Chrome gets ready to mark all HTTP sites as 'bad'
zdnet.com/article/google-chrome-gets-ready-to...
zdnet.com82
I've been running into a bunch of teams that didn't understand this, so I wanted to share.
You don't need a PrivatePKI for your private infrastructure.
DNS-01 challenges prove domain control through a TXT record in your DNS zone. Your server can be on a private subnet, behind a firewall, completely unreachable from the internet. You still get a publicly trusted SSL certificate. One wildcard for *.int.example.com covers everything and keeps internal hostnames out of CT logs.
Worth knowing before you stand up a private CA.
https://www.certkit.io/blog/private-pki-internal-infrastructure
730
