Top all-time · #9880
CertKit SSL Certificate Management
Company blog · certkit.io/blogsecuritysystems
CertKit SSL Certificate Management is the company blog at certkit.io, writing about security and systems. Since 2025, 8 different Hacker News readers have linked it 20 times, most often “What's taking DNS-PERSIST-01 so long?”. It is still writing: the last post was on 2026-11-02, and you can follow it by feed.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers link CertKit's free CT log search tool for listing every certificate issued for a domain, offered as a more reliable alternative to crt.sh. The comments name no writing, only the tool.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
CertKit is SSL/TLS certificate lifecycle management software. Discover, issue, renew, and automatically deploy certificates to Linux, Windows, and vendor appliances, then monitor everything so a certificate never expires on you again.
Most-linked posts?
- What's taking DNS-PERSIST-01 so long?3 people · 3 mentions · first linked 2026-10-10
- /tools/ct-logs/2 people · 2 mentions · first linked 2026-01-25
What Hacker News says?
> What is the problem with stale certificates if a domain changes hands? The previous owners have valid certificates for up to 398 days. If they are a malicious party cable of doing a man-in-the-middle attack, they can present a valid certificate and fully impersonate the owner. For example, when Stripe started, they purchased the domain from another party, who had a valid stripe.com payment certificate for nearly a…
Comment linking /blog/bygonessl-and-the-certificate-that-wouldnt-die
on “Upcoming Changes to Let's Encrypt Certificates”Submitted The 47-Day Certificate Ultimatum: How Browsers Broke the CA Cartel as a story · 12 points
HN discussionFor all the folks worried about how hard automation is going to be, this is what my team and I have been working on for the past year: https://www.certkit.io/certificate-management You CNAME the acme challenge DNS to us, we manage all your certificates for you. We expose an API and agents to push certificates everywhere you need them, and then do real-time monitoring that the correct certificate is running on the we…
Comment linking /certificate-management
on “Upcoming Changes to Let's Encrypt Certificates”Submitted What's taking DNS-PERSIST-01 so long? as a story · 4 points
HN discussionIt's not really a stupid problem, its the BygoneSSL problem: https://www.certkit.io/blog/bygonessl-and-the-certificate-th...
Comment linking /blog/bygonessl-and-the-certificate-that-wouldnt-die
on “Upcoming Changes to Let's Encrypt Certificates”Submitted What's taking DNS-PERSIST-01 so long? as a story · 4 points
HN discussionMan, I agree. The whole thing sucks so much. We started building a centralized way to do this internally last year to get better visibility into renewals and expirations: We're doing a beta of it for some other groups now. https://www.certkit.io/
Comment linking /
on “Upcoming Changes to Let's Encrypt Certificates”Submitted Show HN: CertKit for automating SSL certs to Windows, JKS, and appliances as a story · 4 points
HN discussionIt's more complicated than that. Apple (along with Google and Mozilla) basically held the CA's hostage. They started unilaterally reducing lifetimes. It was happening whether the CAB approved it or not. The vote was more about whether the CAB would continue to be relevant. "Accept the reality, or browsers aren't even going to show up anymore". I wrote a bunch about this recently: https://www.certkit.io/blog/47-day-c…
Comment linking /blog/47-day-certificate-ultimatum
on “Upcoming Changes to Let's Encrypt Certificates”Submitted What's taking DNS-PERSIST-01 so long? as a story · 3 points
HN discussionIf you want to learn more about Certificate Transparency Logs, how to pull and search them, we just did a 3 part series about how we did this at CertKit: https://www.certkit.io/blog/searching-ct-logs
Comment linking /blog/searching-ct-logs
on “It seems that OpenAI is scraping [certificate transparency] logs”Submitted How likely is a man in the middle attack? as a story · 3 points
HN discussionI am talking to so many mid-sized IT shops that still have lots of legacy on-prem windows systems or specialty software where Certbot or ACME renewals is hard. This sort of thing gets dismissed as "just use certbot" in threads like these, and its infuriating. We started building CertKit ( https://www.certkit.io/ ) to centralize ACME for just these sort of things.
Comment linking /
on “Cyber.mil serving file downloads using TLS certificate which expired 3 days ago”Submitted Perfect Forward Secrecy Made Private Keys Boring as a story · 2 points
HN discussionAnother option: https://www.certkit.io/tools/ct-logs/
Comment linking /tools/ct-logs/
on “Ask HN: What are the viable alternatives to DuckDuckGo?”Submitted You probably don't need private PKI for internal infrastructure as a story · 1 points
HN discussionto help with passive reconnaissance, here are tuxnet.dev's SSL certificates and associated subdomains: https://www.certkit.io/tools/ct-logs/?query=tuxnet.dev
Comment linking /tools/ct-logs/?query=tuxnet.dev
on “TLS certificates for internal services done right”I'm working on https://www.certkit.io . It started as a solution to handle TLS certificate automation for my other SaaS products, but we realized other people who run on-prem workloads might get something out of it. It uses Let's Encrypt by default. We use delegated DNS to handle ACME challenge validation (we run the DNS, you just CNAME to us). This means you don't need to give us DNS credentials or anything. And fo…
Comment linking /
on “Ask HN: What Are You Working On? (May 2026)”If you never want this to happen again to your systems, we’re building a tool that bakes monitoring and validation into automatic cert renewals. < https://www.certkit.io/ >
Comment linking /
on “Manjaro website off-line again due to lapsed certificate”crt.sh is a wonderful tool. I applaud anyone who makes CT log searching more available! That said, crt.sh can be woefully unreliable. It often returns errors during a query or is just hard down. Large result sets may never return. Queries often take a very long time. I wanted a more reliable CT log search tool for something I'm working on, so I built a purpose built CT log search tool. I ingest all the data from the…
Comment linking /tools/ct-logs/
on “Show HN: CertRadar – Find every certificate ever issued for your domain”