The month is not even over yet. Open Mozilla’s CA Certificate Compliance community report dashboard, and you will already find nearly a hundred compliance incident reports involving publicly trusted CAs around the world! ...

Recently, Let’s Encrypt officially announced its all-new Gen Y Root Certificate Hierarchy (Generation Y Hierarchy). This update introduces two new root certificates (ISRG Root YR and ISRG Root YE) as well as a series of new intermediate certificates. Without a deeper look, this might seem like just a routine key rotation. But in reality, this architectural adjustment profoundly reflects the dramatic changes occurring in the Web PKI (Public Key Infrastructure) industry. By analyzing this update, we can summarize five core trends for the future of HTTPS and certificate management. ...

The foundation of trust on the internet is quietly evolving. You may have noticed that the little padlock in your browser’s address bar is becoming more common, indicating that a website uses HTTPS encryption—something that relies on SSL certificates. Today, a significant industry development may have a profound impact on all website operators: the CA/Browser Forum (CABF) has passed a proposal called SC-081, which plans to gradually reduce the maximum validity of publicly trusted SSL certificates to just 47 days! What does this change mean, and how will it affect us? Let’s dive in. ...

Recently, I discovered a Grafana Dashboard that can visualize certificate validity, and it works quite well. The configuration is simple, aggregating the validity period, serial number, issuer, and other information of multiple site certificates, making it clear at a glance. I am sharing this blog post with everyone. ...