https://blog.trstctl.com/ Short posts in plain words on certificates, keys and the machines that hold them, from the person building trstctl. en https://blog.trstctl.com/47-days-what-actually-changes https://blog.trstctl.com/47-days-what-actually-changes Mon, 21 Sep 2026 09:00:00 GMT The CA/Browser Forum has cut the lifetime of a public TLS certificate to 47 days by March 2029, and the proof that you own a name to ten days. The schedule, what breaks, and the four moves that make it a non-event. https://blog.trstctl.com/pki-in-plain-words https://blog.trstctl.com/pki-in-plain-words Mon, 21 Sep 2026 09:00:00 GMT Certificates, private keys, authorities, chains, domain-control validation, ACME, expiry, revocation and transparency logs, explained for someone who owns more certificates than they can name. https://blog.trstctl.com/why-the-signer-is-a-separate-process https://blog.trstctl.com/why-the-signer-is-a-separate-process Mon, 21 Sep 2026 09:00:00 GMT Automation has to sign certificates all day. It should never hold the keys. How trstctl draws that line, what the line guarantees, and what it does not, with links to the code. https://blog.trstctl.com/machine-credentials-beyond-tls https://blog.trstctl.com/machine-credentials-beyond-tls Mon, 21 Sep 2026 09:00:00 GMT The 47-day schedule is the visible tip of a bigger shift: every credential a machine holds is moving to short lifetimes. SSH, secrets, tokens, workload identity, code signing and now AI agents, and why one inventory beats seven. https://blog.trstctl.com/stop-buying-certificates-start-owning-renewals https://blog.trstctl.com/stop-buying-certificates-start-owning-renewals Mon, 21 Sep 2026 09:00:00 GMT A public TLS certificate has been free for ten years. What you are still paying for, whether you buy it or not, is the renewal. What free already covers, where a purchase still makes sense, and the five jobs that are yours either way.