Evgeny Akhtimirov

Last SSL cert mistake that hit production? - Expired, nobody noticed - Renewed, one service kept the old one - "Temporary" self-signed, three years later - Wildcard that missed that one subdomain Which was yours? #ssl #tls #buildinpublic

Most sysadmins check cert expiry. Almost nobody checks the chain. Missing intermediate = some browsers trust you, others don't. When did you last inspect your full cert chain? #ssl #tls #buildinpublic

35 comments on my SSL cert tracking post. 8 different tools. Same blind spot. Every tool has a scope. The certs outside it are the ones nobody watches. What's the cert in your stack that no tool currently covers? #ssl #tls #buildinpublic

Worse than an expired SSL cert? One that renewed but didn't deploy. Quiet outages: - LB serves old chain after renewal - Client caches old cert in browser - Auto-renewal in staging, manual in prod Has a "successful" renewal broken your stack? #ssl #tls #buildinpublic

Asked on LinkedIn how people track SSL certs. 4 answers: - IaC drift checks - Certbot + Uptime Kuma - SSL Labs API + alarms - ManageEngine Key Manager None cover the same surface. The cert that bit you last — inside or outside your tool's scope? #ssl #tls #buildinpublic

How do you track SSL cert expiration? Answers I keep hearing: - "A spreadsheet. Probably outdated." - "Google Calendar reminders." - "I find out when it breaks." Building SSLSpy to fix this. What's your method? #devops #ssl #buildinpublic

SSL fact most sysadmins miss: Your cert covers multiple domains via SAN entries. On renewal, SANs can silently get dropped. Main domain? Green padlock. A subdomain on the same cert? Broken. Your monitoring won't catch it — it only checks the primary domain. #ssl #buildinpublic

"How many SSL certs does your company have?" Trick question. Nobody knows. They hide in ACM, load balancers, K8s secrets, internal CAs, vendor portals, that one .pfx from 2019… Then multiply by dev/staging/prod/DR. You can't renew what you can't find.

SC-081 is live. SSL cert lifetimes dropped to 200 days → 100 days next year → 47 days by 2029. Manual cert management is dying. Building SSLSpy — SSL cert scanner & monitor. 20yr .NET/DevOps. Sharing the full journey here. #buildinpublic #devops #ssl