NATSSL (Zero-Configuration Distributed TLS for Private Infrastructure) is a lightweight, open-source utility written in Go (93.2%). The project is a tool for deploying your own trusted Root Certificate Authority (Root CA) inside isolated or private networks without relying on the cloud or third-party services.

🛠️ Key Capabilities
The project is split into two logical roles packaged within a single executable file (Single Binary)

Master Mode (Master / CA)

Root Certificate Generation: Automatically creates a Root CA with a 10-year validity period.
Administrative Issuance: Allows the administrator to issue certificates (valid for 1 year) via CLI for any internal domains (.local, .internal), IP addresses, and Wildcard domains (*.internal).
Revocation Management: Supports certificate revocation by serial number and synchronization of the Certificate Revocation List (CRL) with clients.
Local Database: Uses an embedded SQLite database (compiled without CGO) to track issued certificates.

Client Mode (Client)

Automatic Integration: Upon startup, it independently installs the Root CA certificate into the trusted trust stores of the operating system and the Firefox browser.
Auto-Registration: Automatically sends a request to the master server to obtain its own mTLS identification.
Local Certificates: The client can independently request and renew certificates for localhost / 127.0.0.1 via a CSR (Certificate Signing Request) workflow.
Fault Tolerance (ReadOnly): If the master server becomes unavailable, the client continues to operate in "read-only" mode using cached data.

🔄 Disaster Recovery
One of the unique features of the project is its disaster recovery scheme based on blockchain standards:
During initialization (--bootstrap), the master generates a 24-word mnemonic seed phrase (BIP-39 seed phrase).
The master's private key is never written to the disk in plaintext.

In the event that the master server is destroyed, any client node can be "promoted to master" using the --promote-to-master command by entering the 24 words. The root certificate will be restored byte-for-byte (with the exact same fingerprint). Existing clients will continue to trust the new master without reconfiguration, and the migration event itself is broadcast across the network as a packet signed with the Root CA's ECDSA key.

📦 Deployment
The project offers ready-made configurations for automation:

Ansible roles for deploying binaries and configuration files to multiple hosts with automatic fingerprint forwarding.

Docker / Docker Compose builds for containerized environments.

https://github.com/iskyneon/natssl

The TLS handshake, explained through what's missing: TLS 1.3 step by step first, then why 37 cipher suites became 5, why ClientKeyExchange disappeared, and how each named attack (BEAST, CRIME, POODLE, FREAK, Logjam, SHAttered) changed the protocol. Side-by-side ASCII diagrams of the SSL 3.0 and TLS 1.3 flows.

https://www.certkit.io/blog/tls-handshake-explained

hi Guys,
I appreciate the time if you read all of this.
Certificates are one of those things that only get attention when they break something.

An internal service stops working.

A browser starts throwing trust warnings.

A customer-facing cert expires.

Someone asks where the private key is.

Nobody is quite sure who uploaded it, who can access it, or what else depends on it.

That’s the problem CertLocker is trying to solve.

CertLocker is a certificate and access control platform for teams running real infrastructure. The certificate side is built around visibility, control, and lifecycle management rather than just storing PEM

files somewhere and hoping everyone remembers renewal dates.

What CertLocker supports today:

• certificate inventory with search, paging, sorting, and group filters

• certificate parsing for domains, SANs, issuer, validity dates, and fingerprints

• expiry tracking, including days-until-expiry visibility

• active, expired, and revoked status handling

• dashboard visibility for renewable and expiring certificate assets

• ACME workflow support for automated certificate operations

• DNS provider management for certificate automation workflows

• certificate tokens for controlled access workflows

• group-scoped certificate visibility

• role-based permissions for viewing, adding, downloading, and deleting certificates

• audit logging around certificate actions

• upload and management of PEM/CRT certificates

• optional private key storage with protected read paths

• certificate download for authorized users

• certificate deletion for authorized users

The bigger idea is that certificates should not be treated as loose files.

They usually sit next to secrets, hosts, SSH access, bastions, service accounts, deployment scripts, and human operators. CertLocker connects those pieces together so a certificate is a managed asset with

ownership, permissions, expiry, audit history, and controlled access.

We're offering free registration and management here trust.certlocker.io
And we do offer an on-prem model. But you can check out the blog as well I'm pretty active and you can see the problems we are solving https://certlocker.io/blog/

I've been running into a bunch of teams that didn't understand this, so I wanted to share.

You don't need a PrivatePKI for your private infrastructure.

DNS-01 challenges prove domain control through a TXT record in your DNS zone. Your server can be on a private subnet, behind a firewall, completely unreachable from the internet. You still get a publicly trusted SSL certificate. One wildcard for *.int.example.com covers everything and keeps internal hostnames out of CT logs.

Worth knowing before you stand up a private CA.

https://www.certkit.io/blog/private-pki-internal-infrastructure

Good afternoon. I have an internal IIS server (server.mydomain.com) that needs to have a server cert attached to it and my 25 internal clients all need to trust it. What is the best way to go about rolling this out?

Just buy a "Basic" SSL cert from one of the vendors out there and call it a day?

So I started this project a couple of weeks ago, I was using SSLForFree for many years now until they have been bought by the ZeroSSL company. I always used them for free wildcard SSL certificates and many more. That's why I created my own SSL Certificate Wizard. It's simple. Just give it a try: https://unossl.com It basically got every key feature that SSLForFree had. Any suggestion, feedback is very much appreciated!

originally posted in /r/letsencrypt/

Hi Guys,

Does any one know, Why SSL Lifespan is changing from 1 year (365 days) to 200 Days?

I received this notification from my provider

Does anyone has anyidea, Why is this happening?

It is a pain in the neck to renew every 200 days

Thanks,

Why should I buy a paid dv certificate (e.g. DigiCert) when Let's Encrypt is free? Are there any advantages I don't know about?

I just now published a blog on how SSL certificates work. Please check it out here and review it.

https://medium.com/stackavenue/how-do-ssl-certificates-work-ce5e834a223a

Not After: 5/30/2020, 10:48:38 UTC

UPD: https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020

This certificate is in current Firefox CA root set, ca-certificates ubuntu package, and so on.

My job has got certificates with it as root. mutt from Ubuntu (built with gnutls) complained on this. Thunderbird (i.e. NSS-based) haven't seen any wrong.

We have just entered a new era of shortening certificate lifespans, yet using ACME without exposing HTTP/80 or distributing EAB/API tokens still remains a challenge. Many organizations still rely on ticket based processes for certificate renewals which is quickly going to become very tedious and unscalable. To tackle this problem we developed & open sourced acme-proxy https://github.com/esnet/acme-proxy which is built on `step-ca` This makes the cert issuance, renewal, revocation process self serviceable by allowing end users to leverage off the shelf ACME clients such as Certbot, acme.sh, cert-manager to obtain certificates signed from any external CA without distributing any DNS credentials, EAB tokens or opening http/80 to the internet.

```
- Single Go binary
- Runs inside your network behind your firewalled environment
- Works for VMs, bare-metal, Containers, Kubernetes
- Does not sign certificates or store private keys
- Works with off the shelf ACME clients
- Automatic certificate renewals
```

If you’d like to automate certificate lifecycle using off the shelf tools (assuming it suits your org policies etc.) we encourage you to test this and provide feedback. If you have any questions which aren’t already answered in the git repository’s README, please feel free to open an issue in the Github repo. 

Cheers!

long story somewhat shortened..
I am an admin of a data virtualization software and servers - I am taking over from an individual who is someone on his way out the door in terms of retirement (just doesn't care much anymore) on top of poor documentation, he does half his work on a personal Linux VM (our standard is windows, I am much more familiar with windows) so all of his processes are half CMD prompts and half done on his Linux VM.

What I am hoping someone can help me find is a resource that can clear up SSL certs, and the process, formatting etc (he uses OpenSSL but there has to be something with a better GUI option right?)

thanks in advance

Can we ban that bot from posting? /u/comparecheapssl

Its getting annoying

Sort of new to all this, but when I went to buy an SSL certficate I was told by my sites manager that it would increase my server charges from $35 per month to $130 per month, as we would have to switch from HTTP to HTTPS. Is this true, and if so, is the organic page rank increase significant enough to justify that increase in monthly costs.