All news with #certificate management tag

🔐 Amazon Elastic Kubernetes Service (Amazon EKS) now supports managed certificate authority (CA) rotation with automated safeguards. Amazon EKS will manage the rotation lifecycle and update AWS-managed components to trust the successor CA, while customers must replace worker nodes and update external clients to trust the new CA. Features include advance expiration notifications, automatic successor CA appending and activation, and rollback capability. The feature is available at no additional cost in all commercial AWS Regions and can be managed via CLI, APIs, CloudFormation, and the AWS console.

🛡️ AWS Certificate Manager (ACM) will discontinue support for email-validated public certificates by September 30, 2027, aligning with the CA/B Forum’s March 15, 2028 deprecation of email-based domain validation. Customers must migrate to DNS validation; ACM is updating the UpdateCertificateOptions API to allow in-place switching from email to DNS without changing certificate ARNs. ACM provides a CNAME record for DNS validation and offers a 72-hour window to add it; once validated, ACM will handle automatic renewals. AWS provides console and AWS CLI steps, a migration user guide, and support resources to assist customers through the transition.

🔐 AWS Certificate Manager now allows changing domain validation on existing public TLS certificates from e-mail to DNS without reissuing or changing the ARN. ACM will phase out email validation through 2027 per CA/B Forum mandates; it will stop issuing email-validated certs on March 31, 2027 and stop renewing them on September 30, 2027. Use the console or UpdateCertificateOptions API to switch and add provided CNAME records within 72 hours.

🛡️ Certificate Transparency Monitoring, launched in public beta in 2019, now filters out certificates Cloudflare issues on customers' behalf before sending alerts. This change addresses noisy notifications caused by routine Universal SSL renewals and other Cloudflare-managed certificates. The service is generally available and will only notify customers about certificates issued outside Cloudflare's automated systems. Settings remain available in the Cloudflare dashboard.

🔐 Mozilla revoked the OpenPGP subkey used to sign Firefox and Thunderbird Linux downloads after an unencrypted copy was mistakenly committed to a private repository. The revocation means files signed by the old subkey will stop verifying once users import the revocation; most users are unaffected, but manual verifiers and some RPM-based installs must update keys. A new replacement subkey was published with a 2028 expiry, and Mozilla says audit logs show no evidence of external access despite the revocation reason code indicating compromise.

🔒 This post announces ACME protocol support in AWS Certificate Manager (ACM), enabling customers to use familiar ACME clients like certbot and cert-manager to automate public certificate issuance and renewal. It explains the new ACME endpoint resource, domain validation scopes, EAB credentials, and IAM controls for isolating environments. The article outlines setup steps, operational best practices, and monitoring recommendations to help scale certificate automation securely.

🔒 A proof-of-concept exploit for the “Certighost” Active Directory Certificate Services vulnerability (CVE-2026-54121) was released after Microsoft patched the issue in the July 2026 Patch Tuesday updates. Researchers showed how a low-privileged user can abuse the AD CS “chase” fallback to have a CA contact an attacker-controlled host and issue certificates for targeted machine accounts. The exploit automates PKINIT authentication as a domain controller to obtain Kerberos credentials and perform domain-level actions; Microsoft added validation to the chase process as a fix.

🛡️ AWS Certificate Manager (ACM) now offers a fully managed ACME server endpoint that issues public TLS certificates with 45-day validity from Amazon Trust Services, compatible with any ACMEv2 client such as Certbot, cert-manager, and acme.sh. PKI teams can create managed ACME endpoints with domain scopes, wildcard controls, and delegated issuance without sharing DNS credentials. Domain validation is performed once at the endpoint level, and issuance and renewal activities are auditable via the ACM console, AWS CloudTrail, and Amazon CloudWatch. ACME support is available in all commercial AWS Regions; see ACM pricing and documentation for details.

🛡️ Enterprises are facing an invisible workforce: non-human identities (bots, service accounts, API keys, tokens, certificates) that now often outnumber humans. These ghost identities authenticate constantly across environments and, when unmanaged, accumulate privileges and risks. The industry has seen incidents where forgotten or third-party machine identities enabled widespread breaches, and a looming 2026 certificate-expiration wave threatens cascading outages. Organisations must prioritise governance—discovering NHIs, assigning ownership, auditing privileges, and addressing imminent certificate expirations—before tool selection.

🔒 AWS announced the AWS Workload Credentials Provider, a lightweight client-side tool that automates export and deployment of certificates from AWS Certificate Manager and local caching of secrets from AWS Secrets Manager. It removes the need for custom EventBridge-based automation for certificate renewals, supports Windows and Linux, and works with Apache and NGINX. The provider is open source and compatible with Secrets Manager Agent functionality.

🔐 Amazon CloudFront now supports Online Certificate Status Protocol (OCSP) for viewer mutual TLS (mTLS), allowing real-time validation of client certificate revocation during connection establishment. Previously, revocation was handled via CloudFront Functions and KeyValueStore with static lists. CloudFront now queries the OCSP responder embedded in certificates and caches responses up to 30 minutes. The OCSP result is exposed to connection functions for custom logic.

🔐Amazon CloudFront now supports passthrough mode for viewer mutual TLS (mTLS), enabling customers to forward client certificate chains directly to their origin for validation instead of requiring CloudFront to perform certificate verification. In passthrough mode CloudFront forwards every request and the full client certificate chain to the origin and does not cache responses, ensuring end-to-end authentication is enforced by the origin. Connection functions remain available so you can inspect or transform connection-level data before it reaches your origin. CloudFront mutual TLS (viewer) passthrough is available at no additional cost.

🔐 Amazon CloudFront now supports OCSP revocation checking for viewer mTLS, allowing real‑time validation of client certificate revocation during connection establishment. Previously, customers relied on static revocation lists implemented with CloudFront Functions and KeyValueStore. CloudFront queries the responder URL in the certificate, caches OCSP responses for up to 30 minutes, and exposes the OCSP result in the connection function so customers can apply custom logic such as grace periods, IP exceptions, or combined revocation strategies. This feature is available at no additional cost.

🔒 AWS announced that AWS IoT Core now supports customer managed domains in the AWS GovCloud (US) Regions. Customer managed domains let you configure custom domain names, use server certificates stored in AWS Certificate Manager, attach custom authorizers, and create multiple data endpoints. This provides stable TLS behavior and simplifies migration of existing devices without changing device credentials or CA certificates.

🔍 AWS Certificate Manager (ACM) now provides a console search bar and a new SearchCertificates API to locate certificates by domain name, certificate ARN, or validity range. Administrators managing large certificate inventories can combine parameters to quickly find certificates that are expiring soon or match specific criteria. The capability supports both ad hoc console queries and scripted automation via the API. This feature is available in Public AWS, AWS China, and AWS GovCloud regions.

🔔 AWS announced that AWS Private Certificate Authority (AWS Private CA) now publishes CA utilization metrics to Amazon CloudWatch, providing visibility into certificate issuance counts and the number of CAs per Region. The metrics track certificates issued by each CA and total CAs in a Region, enabling CloudWatch alarms and automation to replace or transition CAs approaching quota limits. This capability helps prevent quota-related service disruptions for services such as Amazon EKS, Amazon ECS Service Connect, and Amazon WorkSpaces.

🔐 The cryptographic foundation of the internet is undergoing a rapid operational reset driven by shorter certificate lifecycles and the transition to quantum-resistant algorithms. The CA/Browser Forum reduced public TLS validity to 200 days on March 15, 2026, with further reductions planned to 100 days in 2027 and 47 days by 2029, dramatically increasing renewal velocity. Manual certificate processes and spreadsheets will not scale; organizations need network-native discovery, continuous certificate visibility, and fully automated lifecycle management. Palo Alto Networks' Next-Generation Trust Security brings certificate lifecycle controls into the network to automate discovery, renewal, deployment and governance.

🔒 AWS Private CA Connector for SCEP now supports AWS PrivateLink, enabling clients within an Amazon VPC to request certificates without traversing the public internet. The managed AWS Private CA Connector for SCEP uses SCEP to automate certificate enrollment and renewal for mobile, network, and IoT devices. PrivateLink removes the need for internet gateways, NAT devices, or VPNs while keeping traffic on the AWS network.

🔐 Cloudflare Radar is adding three security-focused datasets and tools: origin-facing post-quantum (PQ) monitoring, a Key Transparency dashboard for E2EE messaging logs, and enhanced RPKI ASPA adoption tracking. The origin feature reports support for X25519MLKEM768 using an automated TLS scanner and provides an on-demand hostname tester that performs real TLS handshakes via Cloudflare Containers. Key Transparency publishes auditor verification status and APIs for independent proof checks, while routing pages gain global, country, and per-AS ASPA views together with API access for integrations.

🔒 ASPA (Autonomous System Provider Authorization) introduces cryptographic path validation to reduce route leaks by allowing networks to publish signed lists of authorized upstream providers in RPKI. Unlike ROAs, which verify prefix origins, ASPA validates the AS_PATH and detects routing "valleys" that indicate leaks. Cloudflare Radar now tracks ASPA adoption across RIRs and provides per‑AS visibility so operators can see whether observed upstreams are ASPA‑authorized and monitor changes over time.