03. writing
Notes on the parts of PKI that are unglamorous and load-bearing — mostly about the failure modes, because those are what the job actually consists of.
Your certificate inventory is exact. Your tickets are not.
Code owns expiry, chains and CAA. A decision model reads the ticket. What happened when I measured it against an ordinary LLM.
An expiring certificate breaks one service. An expiring CA breaks all of them.
Everyone automates leaf certificates. Almost nobody has a renewal script for an issuing CA — and the blast radius is not comparable.
What Certificate Transparency tells you about your own estate
CT was built so the world could audit certificate authorities. It turns out to be the cheapest inventory tool you have for your own domains.
Post-quantum: the half you can fix today
Signatures are a planning problem. Key exchange is a shipping problem, and it has already shipped — in your standard library.