Top all-time · #1774
SSLMate Blog
Company blog · sslmate.com/blog · on HN as agwasecurity
SSLMate Blog is the company blog at sslmate.com, writing about security. Since 2014, 42 different Hacker News readers have linked it 74 times, most often “Certificate Transparency Log Monitor”. It is still writing: the last post was on 2025-06-02, and you can follow it by feed.
Too few sampled comments (28) to say how often HN recommends it.?
Why HN links it
HN readers link SSLMate for fast command-line certificate buying and automatic renewal, and for its Cert Spotter tool that monitors Certificate Transparency logs. Some also cite its posts on CA failures.
Summarised by Claude from a sample of 28 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Certificate Transparency Log Monitor11 people · 11 mentions · first linked 2017-10-23
- SSLMate – Buy SSL certs from the command line10 people · 11 mentions · first linked 2014-07-16
- SSLMate – Buy SSL certs from the command line4 people · 7 mentions · first linked 2014-09-20
- Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate4 people · 5 mentions · first linked 2016-09-07
- Certificate Authority Failures4 people · 4 mentions · first linked 2022-07-25
- Show HN: CAA Record Generator2 people · 3 mentions · first linked 2017-08-31
- GoDaddy Issues Certificates That Don't Work in Safari (Again)2 people · 2 mentions · first linked 2025-06-02
- Generate Secure Configuration with `sslmate mkconfig`2 people · 2 mentions · first linked 2014-12-19
- The Entrust Distrust Will Be More Disruptive Than Intended2 people · 2 mentions · first linked 2024-11-21
- OCSP Watch2 people · 2 mentions · first linked 2022-03-22
What Hacker News says?
Quick plug for a company I've used: SSLmate ( http://sslmate.com ) makes cert purchase (for those whom need this) painless and fast. They use Comodo and Geotrust FWIW. I've had my own pain with Comodo through other resellers, and moved on to sslmate and godaddy. Recently moved my home blog ( http://scalability.org ) to LE. Work ( http://scalableinformatics.com ) is using godaddy for now, though thinking hard on usin…
Comment linking /
on “Defending Our Brand”Submitted Why Chrome 53 Is Rejecting Chase Bank's Symantec Certificate as a story · 213 points
HN discussionSSLmate ( https://sslmate.com/ ) actually makes things similarly simple — I've been using them for a few months now.
Comment linking /
on “Our First Certificate Is Now Live”Submitted SSLMate – Buy SSL certs from the command line as a story · 118 points
HN discussionSSLMate seems pretty easy as well: https://sslmate.com/ (No affiliation, I just saw their HN post some time before)
Comment linking /
on “Our First Certificate Is Now Live”Submitted Show HN: Certificate Transparency Log Monitor as a story · 53 points
HN discussionI'm the founder of SSLMate, which resells Comodo and GeoTrust certs with an automated, ACME-like API: https://sslmate.com Our API predates ACME, but we'll most likely be implementing ACME once it's finalized.
Comment linking /
on “WoSign and StartCom: Mozilla’s proposed conclusion”Submitted SHA-2 Certificates Now Available from SSLMate as a story · 16 points
HN discussionI would approach the issue rom the opposite direction. What is the minimum failure of any CA required for me to get popped? If some malicious actor goes through the effort to get me, how many other clients/servers on the internet can get from the same CA breach / malicious cert? How would you know to un-trust a CA you already trust until after the incident (a malicious certificate issued) had already happened? Even…
Comment linking /resources/certificate_authority_failures
on “OpenSSL 3.0.7 fixes X.509 email address buffer overflows”Submitted Show HN: CAA Record Generator as a story · 11 points
HN discussionIt prevents attack vectors that involve attacker-owned certificate authorities as well as compromised certificate authorities from exposing user-data. https://sslmate.com/resources/certificate_authority_failures
Comment linking /resources/certificate_authority_failures
on “Cracking Meta's Messenger Certificate Pinning on macOS”Submitted SSLMate – Buy SSL certs from the command line as a story · 5 points
HN discussionThe state of things really does suck, and I'm trying to do something about it. SSLMate [ https://sslmate.com ] sells SSL certs from the command line for $15.95/year. The sslmate command line tool takes care of properly generating the key and CSR, and properly assembling the certificate bundle containing the chain certificate. Certificates secure both example.com and www.example.com. No more hard-to-use websites or o…
Comment linking /
on “FFS SSL”Submitted GoDaddy Issues Certificates That Don't Work in Safari (Again) as a story · 3 points
HN discussionI'm working on this problem: https://sslmate.com/ Right now it's just a command line client, but a public API is in the works. And this week we'll be announcing a solution to the cert rotation problem (basically, you'll be able to drive your renewals from cron - it's going to be really cool). You might want to follow @sslmate on Twitter - this is just the beginning of some very exciting stuff for automating SSL cert…
Comment linking /
on “Why Google is Hurrying the Web to Kill SHA-1”Submitted The Entrust Distrust Will Be More Disruptive Than Intended as a story · 3 points
HN discussionAfter I created OCSP Watch[1], I regularly detected CAs returning an OCSP response of unknown or unauthorized for certificates found in CT logs, indicating that they had basically forgotten that they had issued a certificate. I find that rather troubling. Indeed, OCSP Watch is currently reporting several forgotten NETLOCK certificates. (The certificates from other CAs are recently issued and will probably have OCSP…
Comment linking /labs/ocsp_watch/
on “Intent to end OCSP service”Submitted Certificate Authority Failures as a story · 3 points
HN discussionhttps://sslmate.com/certspotter/
Comment linking /certspotter/
on “Microsoft Teams outage due to expired certificate”Submitted Elizabeth Warren's Website Uses a Foreign TLD. [ ] Certificate Transparency as a story · 3 points
HN discussionYeah, Cert Spotter does this ( https://sslmate.com/certspotter/ ). It's a huge help both to be able to monitor cert issuance for a domain and all of its subs, and to be reminded when a cert is expiring.
Comment linking /certspotter/
on “Microsoft Teams outage due to expired certificate”Submitted Tool to help generate DNS CAA record for SSL certs as a story · 3 points
HN discussion> Root cause: Symantec was willfully disregarding industry regulations by issuing trusted certificates without proper authorization. Source: https://sslmate.com/certspotter/failures “Willfully” is the key word here. The business side of running a CA is fundamentally at odds with the security side. A few short-sighted decisions by business-minded managers with their eyes set on profits can completely eviscerate the s…
Comment linking /certspotter/failures
on “Distrust of Symantec TLS Certificates”Submitted Generate Secure Configuration with `sslmate mkconfig` as a story · 3 points
HN discussionBTW, all the recent certificate shenanigans have invovled for-profit CAs [1]. [1]: https://sslmate.com/resources/certificate_authority_failures
Comment linking /resources/certificate_authority_failures
on “SSL Configuration Generator”Submitted SSLMate – Buy SSL certs from the command line as a story · 3 points
HN discussionIsn't that what the DNS Certification Authority Authorization (CAA) DNS record [1] is supposed to solve? Combine that with certificate transparency enforced with the `Expect-CT` header [2] and its pretty locked down. If a CA does not respect the CAA record and issues anyways, the cert will be logged to a public log. Tools like CertSpotter [3] can be setup to give notifications when certs are created. If a cert is cr…
Comment linking /signup?for=certspotter
on “Senator requests better https compliance at US Department of Defense [pdf]”Submitted GoDaddy Issues Certificates That Don't Work in Safari (Again) as a story · 2 points
HN discussionCheck out SSLMate, which has been automating certificate issuance since early last year: https://sslmate.com We have both an API and a highly scriptable open source command line client.
Comment linking /
on “Add Amazon root certificates”Submitted Certspotter removes free tier; adds features as a story · 2 points
HN discussion
