# certificates Published articles for certificates. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## JDK 27 Security Enhancements DevFeed: [JDK 27 Security Enhancements]() Original publisher: [Read original article]() Author: Sean Mullan Published: 2026-09-16T00:00:00Z Content type: article Language: en Sources: [Inside Java]() Topics: [JDK 27](), [Security](), [Cryptography](), [Encryption](), [TLS (Transport Layer Security)](), [Post-Quantum](), [Release notes]() Tags: [certificates](), [cryptographic](), [encryption](), [jdk-27](), [notes](), [password](), [post-quantum](), [private-key](), [release-notes](), [security](), [tls]() ### AI overview This article reviews selected security enhancements in JDK 27, released on September 15, 2026. It highlights TLS 1.3 support for post-quantum hybrid key exchange mechanisms and the third preview of the PEM API for encoding and decoding cryptographic objects. ### Source excerpt JDK 27 was released on September 15, 2026! As with my previous blogs, I have compiled a list of what I think are the most interesting and useful security enhancements in this release. I have also grouped them into appropriate categories (crypto, TLS, etc) which should make it easier to find out what has changed in each specific area. The JDK 27 release notes also contain further details on these and other enhancements. ## CAA DNS Issuer-Critical Flags Are Confusing to Configure DevFeed: [CAA DNS Issuer-Critical Flags Are Confusing to Configure]() Original publisher: [Read original article]() Author: Remy Porter Published: 2026-09-10T06:30:00Z Content type: opinion Language: en Sources: [The Daily WTF]() Topics: [certificates](), [domain]() Tags: [bits](), [boolean](), [certificates](), [documentation](), [feature-articles](), [flag](), [https](), [readability]() ### AI overview The article examines confusion around the issuer-critical flag in DNS CAA records. It explains that the flag is defined as a bitmask, while many users interpret the documentation as requiring the integer 1 instead of the value representing the specified bit, creating a dilemma for certificate issuers such as LetsEncrypt. ### Source excerpt I'm not a DNS person, in that I appreciate that it exists but am not up on the inner workings. It solves a lot of problems with dark magic I don't fully understand, and fortunately don't need to. But Lucio noticed something that I do think is interesting, within the scope of the CAA record type. The CAA record started with RFC6844, which was obsoleted by RFC8659. Both RFCs lay out the same core idea: you can add a CAA record to your DNS entries to say, "hey, this domain over here is allowed to issue certificates for me". That's the sort of thing that enables LetsEncrypt to hand out certs, and is an important part of why we can run HTTPS everywhere these days. Now, RFC6844 has this in it: Issuer Critical: If set to '1', indicates that the corresponding property tag MUST be understood if the semantics of the CAA record are to be correctly interpreted by an issuer. Issuers MUST NOT issue certificates for a domain if the relevant CAA Resource Record set contains unknown property tags that have the Critical bit set. The issuer critical flag means that the certificate issuer needs to validate your CAA record before it issues a certificate for you. There's more in the RFC about what exactly that means, but we don't care about those details for right now. The rule here is "set a flag to 1". A little later in the RFC, the flag is described in more detail- as a bitmask. Specifically, bit 0 is the issuer critical flag. Bits 1-7 are reserved for future use. Now, here's where we get into trouble, because programmers don't understand bits, and because the CAA record expects you to put an integer in this field. So, if you want issuer critical enabled, what value to you put in this field? 128, obviously. That's 10000000. Except, if you don't understand bits, that's not obvious. A lot of people read this and decided that the documentation meant they needed to put 1 in the field- aka 00000001. This is wrong. The updated RFC tries to explain it a bit more clearly: Bit 0, Issuer Critic ## FIPS 140-2 vs FIPS 140-3, Explained DevFeed: [FIPS 140-2 vs FIPS 140-3, Explained]() Original publisher: [Read original article]() Author: info@goteleport.com (Mayur Pipaliya) Published: 2026-09-09T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [fips 140-3](), [FIPS validation](), [Cryptography](), [Encryption](), [certificates](), [Security](), [Cloud]() Tags: [certificates](), [cloud](), [cmvp](), [cryptography](), [encryption](), [fedramp](), [fips](), [fips-140-3](), [fips-validation](), [security](), [sensitive-data]() ### AI overview This article explains the differences between FIPS 140-2 and FIPS 140-3, including the standards' origins, CMVP validation certificates, applicable requirements for protecting sensitive data, and the transition timeline through September 2026. ### Source excerpt Understand key changes from FIPS 140-2 to FIPS 140-3. ## Rotating Expiring X.509 Certificates in Percona Server for MongoDB with Minimal Service Interruption DevFeed: [Rotating Expiring X.509 Certificates in Percona Server for MongoDB with Minimal Service Interruption]() Original publisher: [Read original article]() Author: Ivan Groenewold Published: 2026-08-31T11:48:11Z Content type: tutorial Language: en Sources: [Blog - Percona]() Topics: [MongoDB](), [TLS (Transport Layer Security)](), [Authentication](), [configuration]() Tags: [authentication](), [certificates](), [insight-for-dbas](), [mongodb](), [private-key](), [rotation](), [security](), [tls](), [x509]() ### AI overview This tutorial explains how to renew same-CA X.509 certificates in Percona Server for MongoDB with minimal service interruption. It covers reloading TLS material with rotateCertificates, certificate and private-key configuration, limitations, validation, and cases where hot reload should not be used. ### Source excerpt Expired TLS certificates can prevent new client connections and, when X.509 is used for Percona Server for MongoDB internal authentication, also prevent members of a replica set or sharded cluster from authenticating to one another. In this post we will discuss performing a same-CA renewal: replacement certificates for server, member, and client leaf are issued ... Continued The post Rotating Expiring X.509 Certificates in Percona Server for MongoDB with Minimal Service Interruption appeared first on Percona. ## Security Baked Into the JVM: two Subjects, one call DevFeed: [Security Baked Into the JVM: two Subjects, one call]() Original publisher: [Read original article]() Author: Peter Firmstone Published: 2026-08-09T00:00:00Z Content type: article Language: en Sources: [Nicolas Fränkel]() Topics: [Security](), [SPIFFE](), [SPIRE]() Tags: [certificates](), [dirtychai](), [java](), [jgdms](), [jini](), [jvm](), [jwt](), [microservices](), [oidc](), [permission](), [process](), [security](), [spiffe](), [spire](), [technical]() ### AI overview This article examines identity and security in the JVM through DirtyChai. It describes separate process and user identities, including SPIFFE workload credentials delivered through SPIRE and JWT/OIDC-based user identity, and explains how these identities coexist across request dispatch and privilege boundaries. ### Source excerpt The constraint system stops a bad call before it leaves the JVM. The Safe Codebase Audit Pipeline stops bad code before a client ever loads it. What remains is identity: who is calling, and can you verify it? Most frameworks answer with a token check at the door. A filter validates a bearer token, sets a thread-local variable, and hopes that nothing downstream forgets to look at it. DirtyChai answers differently. ## OpenAI's Ten Mathematical Results Tested Through Lean Certificates DevFeed: [OpenAI's Ten Mathematical Results Tested Through Lean Certificates]() Original publisher: [Read original article]() Published: 2026-08-01T00:00:00Z Content type: article Language: en Sources: [Alex Korbonits]() Topics: [Lean](), [OpenAI](), [certificates](), [trust](), [Artificial Intelligence]() Tags: [ai](), [certificates](), [openai](), [paper](), [trust]() ### AI overview The article examines OpenAI's release of ten results on long-standing mathematical problems and reports independently building and checking the accompanying Lean certificates. It says all 38 headline theorems passed with no errors or non-standard axioms, while raising concerns about trusting definitions written by the same system that produced the proofs. ### Source excerpt OpenAI shipped ten open problems with Lean certificates. I built all 550,000 lines and checked what they rest on. Everything passed -- and the only thing left to trust is 1,700 lines of definitions written by the same system that wrote the proofs. ## Codename One's Certificate Wizard Becomes a Standalone App Using App Store Connect API Keys DevFeed: [Codename One's Certificate Wizard Becomes a Standalone App Using App Store Connect API Keys]() Original publisher: [Read original article]() Author: Shai Almog Published: 2026-07-11T00:00:00Z Content type: article Language: en Sources: [CodeName One]() Topics: [iOS](), [API keys](), [Authentication](), [Development]() Tags: [api](), [app](), [apple](), [authentication](), [certificates](), [desktop](), [ios](), [release](), [signing]() ### AI overview Codename One's certificate wizard has been rewritten as a standalone desktop app for iOS developers. It replaces Apple ID login with an App Store Connect API key for managing certificates, bundle IDs, devices, provisioning profiles, and push keys. ### Source excerpt The certificate wizard is now a standalone desktop app that authenticates with an App Store Connect API key instead of your Apple ID login. ## Automatic CA Certificate Import in Podman 6 DevFeed: [Automatic CA Certificate Import in Podman 6]() Original publisher: [Read original article]() Author: Mario Loriedo Published: 2026-07-08T09:26:23Z Content type: article Language: en Sources: [blog.podman.io]() Topics: [podman](), [Containers](), [cross-platform](), [configuration](), [Go](), [Linux](), [macOS](), [Windows](), [Windows Subsystem for Linux]() Tags: [announcement](), [articles](), [certificates](), [community](), [configuration](), [containers](), [cross-platform](), [developers](), [enterprise](), [go](), [linux](), [macos](), [new-feature](), [podman](), [podman-machine](), [providers](), [qemu](), [security](), [windows](), [wsl]() ### AI overview Podman 6 introduces optional automatic import of trusted host CA certificates into Podman Machine guests. The feature synchronizes certificates on machine boot, helping containers access internal registries and web services without manual certificate export and injection. ### Source excerpt With the release of Podman 6.0, an improvement for enterprise users and developers behind corporate proxies is the new automatic import of host certificates for the Podman machine. ## How to import multiple iOS signing certificates to CI DevFeed: [How to import multiple iOS signing certificates to CI]() Original publisher: [Read original article]() Author: Marco Gomiero Published: 2026-07-02T00:00:00Z Content type: tutorial Language: en Sources: [Posts on Marco Gomiero]() Topics: [GitHub Actions](), [certificates](), [iOS](), [ci]() Tags: [app-store](), [apple](), [certificates](), [ci](), [distribution](), [github](), [github-actions](), [how-to](), [ios](), [secrets](), [signing]() ### AI overview A tutorial explaining how to export multiple iOS signing certificates, combine them into a certificate file, encode it with base64, and store it as a GitHub secret for use in GitHub Actions. ### Source excerpt Some time ago, I shared the GitHub Actions workflow that I use for deploying the iOS version of FeedFlow to the App Store. How to publish a Kotlin Multiplatform iOS app on App Store with GitHub Actions One step of that CI job is setting up the required certificates for signing the app: Apple Development and Apple Distribution. In the past, it was possible to extract these two certificates from the local Keychain by selecting them and using the Export 2 items... option. ## Post-Quantum Certificates DevFeed: [Post-Quantum Certificates]() Original publisher: [Read original article]() Published: 2026-06-27T16:17:41Z Content type: article Language: en Sources: [Signs of Triviality]() Topics: [certificates](), [Post-Quantum](), [TLS (Transport Layer Security)](), [Web]() Tags: [2026](), [certificates](), [post-quantum](), [tls](), [web]() ### AI overview A summary of post-quantum certificates and the TLS and web-PKI ecosystem as of June 2026. ### Source excerpt A summary of post-quantum certificates and the TLS / web-PKI ecosystem as of June 2026. ## SOC 2 Controls for Non-Human Identities: CC6, CC7, and CC8 DevFeed: [SOC 2 Controls for Non-Human Identities: CC6, CC7, and CC8]() Original publisher: [Read original article]() Author: info@goteleport.com (Kayne McGladrey) Published: 2026-06-09T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [soc 2](), [audit](), [Authorization](), [sigstore]() Tags: [audit](), [authorization](), [certificates](), [credentials](), [soc-2]() ### AI overview This article explains how Teleport maps workload attestation, short-lived certificates, access rules, and audit logs for non-human identities to SOC 2 controls CC6, CC7, and CC8. It describes evidence auditors can use, including access rules, denied credential issuance logs, and Sigstore policy configurations where enabled. ### Source excerpt Discover how to meet SOC 2 CC6, CC7, and CC8 controls for non-human identities. ## How to Eliminate Shared Database Passwords: MySQL, PostgreSQL, and More DevFeed: [How to Eliminate Shared Database Passwords: MySQL, PostgreSQL, and More]() Original publisher: [Read original article]() Author: info@goteleport.com (Dan Johns) Published: 2026-06-05T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Databases](), [MySQL](), [PostgreSQL](), [certificates](), [passwords](), [Single sign-on (SSO)](), [audit](), [Authorization]() Tags: [apply](), [audit](), [certificates](), [credentials](), [cryptographic](), [database](), [how-to](), [mysql](), [passwords](), [permissions](), [policy](), [postgresql](), [sso]() ### AI overview A guide to replacing shared database passwords and standing privileges with short-lived certificates and identity-based access. It explains how Teleport supports MySQL, PostgreSQL, and other databases, including role-based permissions, hardware-key approval for writes, and query-level attribution in audit logs. ### Source excerpt Learn how to access MySQL, PostgreSQL, and other databases using short-lived certificates instead of shared passwords. ## Deconstructing OkHttp DevFeed: [Deconstructing OkHttp]() Original publisher: [Read original article]() Author: Jesse Wilson Published: 2026-05-22T12:00:00Z Content type: article Language: en Sources: [Public Object]() Topics: [Library](), [Network](), [Code](), [Kotlin](), [implementation](), [Cache](), [certificates]() Tags: [architecture](), [cache](), [certificates](), [https](), [implementation](), [kotlinconf](), [ktor](), [library](), [network](), [okhttp](), [performance](), [presentation](), [retrofit](), [testing]() ### AI overview A KotlinConf talk examines OkHttp's implementation rather than its basic usage, covering interceptor-based architecture, connection lifecycles, cache state machines, URL decoders, HTTPS testing certificates, performance, and extension mechanisms. ### Source excerpt I presented this at KotlinConf on May 22, 2026. Also available on slides, YouTube, and Speaker Deck. OkHttp is a popular library for making network calls. You might use it directly, or with Ktor, Retrofit, Coil, or gRPC. But this is not a talk on how to use OkHttp. Instead, ## How to Extend SPIFFE Beyond Kubernetes: Bring Zero Trust Identity to Your VMs DevFeed: [How to Extend SPIFFE Beyond Kubernetes: Bring Zero Trust Identity to Your VMs]() Original publisher: [Read original article]() Author: info@goteleport.com (Jeffrey Ellin) Published: 2026-05-21T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [SPIFFE](), [Zero Trust](), [certificates](), [istio](), [Kubernetes]() Tags: [api](), [certificates](), [istio](), [kubernetes](), [mesh](), [spiffe](), [zero-trust]() ### AI overview This tutorial explains how to extend SPIFFE-based zero-trust workload identity beyond Kubernetes to VMs, edge gateways, and legacy services. It describes separating identity issuance from consumption, using short-lived identities through a local API, with Envoy consuming identity via SDS and Teleport managing the trust chain. ### Source excerpt Discover how Envoy + SDS and Teleport Workload Identity let off-cluster workloads securely call Istio services without distributing certificates. ## Guide: How to Unify Identity Across Cloud and Data Center Infrastructure DevFeed: [Guide: How to Unify Identity Across Cloud and Data Center Infrastructure]() Original publisher: [Read original article]() Author: info@goteleport.com (Mayur Pipaliya) Published: 2026-05-01T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [IAM](), [trust](), [certificates](), [SPIFFE](), [Cloud](), [data centers](), [Amazon Web Services](), [Entra ID]() Tags: [certificates](), [cloud](), [critical-infrastructure](), [data-center](), [entra-id](), [identity](), [identity-and-access](), [infrastructure](), [spiffe]() ### AI overview This guide explains identity fragmentation across cloud accounts, data centers, and colocated infrastructure. It describes siloed identity systems, credential sprawl, and differing access models, and presents approaches including hardware roots of trust, short-lived certificates, shared certificate authorities, SPIFFE workload identities, reverse tunnels, and protocol-level enforcement. ### Source excerpt Inside this guide, discover the root causes of identity fragmentation across cloud and data center environments -- and what it takes to unify identity. ## CMMC Phase 2, explained: Requirements, deadlines, and who's affected DevFeed: [CMMC Phase 2, explained: Requirements, deadlines, and who's affected]() Original publisher: [Read original article]() Published: 2026-04-29T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Cybersecurity](), [Security & Privacy](), [Cryptography](), [vulnerability management](), [vulnerability scanning](), [Encryption](), [MFA]() Tags: [certificates](), [cmmc](), [cmmc-container-images](), [cmmc-phase-2](), [cmvp](), [compliance](), [cve](), [cybersecurity-maturity-model-certification](), [fips](), [nist](), [sboms](), [stig](), [stigs](), [supply-chain](), [u-s-dod](), [vulnerability-management](), [vulnerability-scanning]() ### AI overview This article explains the requirements, deadlines, and scope of CMMC Phase 2. It describes the CMMC Level 2 certification requirements for organizations handling Controlled Unclassified Information or supporting Department of Defense and certain civilian agency contracts, including MFA, encryption, vulnerability scanning, supported systems, independent assessments, and compliance documentation. ### Source excerpt CMMC Phase 2 and NIST 800-171 are here. Learn how Chainguard helps teams meet compliance with FIPS, STIGs, and zero-CVE containers. ## CockroachDB Plans Native X.509 SAN Support for SPIFFE and SPIRE Integration DevFeed: [CockroachDB Plans Native X.509 SAN Support for SPIFFE and SPIRE Integration]() Original publisher: [Read original article]() Author: Sanchit Khanna,Biplav Saraf Published: 2026-03-13T00:00:00Z Content type: article Language: en Sources: [Cockroach Labs]() Topics: [CockroachDB](), [Databases](), [SPIFFE](), [SPIRE](), [certificates](), [Zero Trust](), [Security](), [Microservice]() Tags: [architectures](), [auditability](), [aws-iam](), [certificates](), [cockroachdb](), [compliance](), [cryptographic](), [database](), [distributed](), [processor](), [regex](), [security](), [soc](), [soc-2](), [spiffe](), [spire](), [standards](), [teams](), [verification](), [zero-trust]() ### AI overview The article previews planned CockroachDB authentication support for Subject Alternative Name fields in X.509 certificates. It explains how SAN support is intended to enable integration with SPIFFE and SPIRE and support regex-based identity mapping for cloud-native workloads. ### Source excerpt In the evolution of cloud-native security, identity has become the new perimeter. ## Preparing for Shorter SSL/TLS Certificate Lifetimes DevFeed: [Preparing for Shorter SSL/TLS Certificate Lifetimes]() Original publisher: [Read original article]() Author: Emily Huang Published: 2026-03-06T16:50:10Z Content type: article Language: en Sources: [Heroku]() Topics: [Heroku](), [TLS (Transport Layer Security)](), [certificates](), [AWS Certificate Manager](), [maintenance](), [Security]() Tags: [automation](), [certificates](), [heroku](), [maintenance](), [news](), [security](), [ssl](), [tls]() ### AI overview Heroku explains that publicly trusted SSL/TLS certificates will have shorter maximum lifetimes, with a 200-day maximum beginning March 15, 2026. Users who manually manage certificates for Heroku applications will need more frequent renewals, while Heroku Automated Certificate Management handles certificate renewal automatically. ### Source excerpt The web browser and certificate authority industry is shortening the maximum allowed lifetime of TLS certificates. These changes will improve security on the Web, but you may have to change certificate maintenance practices for apps you run on Heroku. The good news is that if you're using Heroku Automated Certificate Management, no changes are required: [...] The post Preparing for Shorter SSL/TLS Certificate Lifetimes appeared first on Heroku. ## Using Mitmproxy to Observe kubectl Traffic DevFeed: [Using Mitmproxy to Observe kubectl Traffic]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-03-04T22:30:00Z Content type: tutorial Language: en Sources: [Scott's Weblog]() Topics: [Kubernetes](), [kubectl](), [Linux](), [Ubuntu](), [Authentication](), [Network](), [macOS](), [Amazon Web Services]() Tags: [apt](), [authentication](), [aws](), [certificates](), [cilium](), [cli](), [cloud](), [cni](), [commands](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubectl](), [kubernetes](), [linux](), [macos](), [networking](), [oci](), [security](), [tutorial](), [ubuntu]() ### AI overview This tutorial explains how to use mitmproxy to observe traffic between kubectl and the Kubernetes API Server. It describes the tested Linux and Ubuntu environment, notes that the commands should work similarly on macOS, and discusses extracting client certificates from a Kubeconfig file for certificate-based authentication. ### Source excerpt When I first started learning Kubernetes, I had the idea that observing the network traffic between a client system using kubectl and the Kubernetes API Server would be a useful thing to do. The source of the idea is unclear; I am unsure why I thought this would be useful as a learning tool. Regardless, I continued on with learning Kubernetes and never really pursued this idea--until this week. I found it can be a useful troubleshooting technique, but I will leave it up to you to determine if it is a useful learning technique. In this post, I will show you how to observe kubectl traffic using mitmproxy. This technique is inspired by/informed by Ahmet Alp Balkan's similarly-named blog post from 2019. Unfortunately, I found the instructions there to be incomplete (most likely just due to the passage of time and continued evolution of the tools involved). I used the following tools and environments in my testing: The tests were conducted on a Linux system running Ubuntu 24.04.4. The commands should work similarly on macOS. Mitmproxy was installed from the Ubuntu repositories using apt. kubectl version 1.33.3 was used to communicate to a self-managed cluster on AWS (in other words, not Amazon EKS) running Kubernetes 1.32.9. The cluster was bootstrapped using kubeadm. I wouldn't expect any major/significant differences with other versions of kubectl or Kubernetes. I was using a client certificate to authenticate to Kubernetes. It's unclear to me how this might work--if it works at all--with alternate authentication mechanisms. Prepare Client Certificates Before you can start mitmproxy, you'll first need to extract the client certificates from the Kubeconfig file. A couple of ways exist to do this; a blog post of mine from 2022 contains what I believe is the easiest way. The method involves yq (to extract information from the Kubeconfig) and base64 (to decode the client certificate and client key). Refer to the linked blog post for full details. First, extract the client cer ## How to Secure Microservices with SPIFFE and Istio DevFeed: [How to Secure Microservices with SPIFFE and Istio]() Original publisher: [Read original article]() Author: info@goteleport.com (Jeff Ellin, Boris Kurktchiev) Published: 2026-02-20T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [istio](), [Microservices](), [SPIFFE](), [Zero Trust](), [Authorization](), [Architecture & Design](), [Secrets Management](), [certificates]() Tags: [architecture](), [authorization](), [backend](), [certificates](), [cloud-native](), [firewalls](), [how-to](), [istio](), [kubernetes](), [microservices](), [policies](), [secrets-management](), [security](), [service-mesh](), [spiffe](), [zero-trust]() ### AI overview This guide explains how to secure microservices with SPIFFE identities, Istio service-mesh mTLS, short-lived certificates, and Zero Trust authorization policies. It addresses the limits of network-based trust and long-lived certificates in dynamic Kubernetes environments. ### Source excerpt Learn how to deploy a secure microservices application, configure default-deny authorization policies, and rebuild service connectivity with SPIFFE-based allow rules. ## DevOps Credential Hygiene: How to Eliminate CI/CD Secrets with Teleport DevFeed: [DevOps Credential Hygiene: How to Eliminate CI/CD Secrets with Teleport]() Original publisher: [Read original article]() Author: meina.ghafouri@goteleport.com (Meina Ghafouri) Published: 2025-12-22T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [DevOps](), [CI/CD](), [certificates](), [Security](), [audit]() Tags: [api-keys](), [certificates](), [ci-cd](), [devops](), [environment-variables](), [passwords](), [private-key](), [secrets](), [security]() ### AI overview This tutorial explains the risks of static credentials in DevOps and CI/CD pipelines, including difficult rotation and broad exposure across infrastructure. It presents short-lived certificates and workload identity as ways to reduce risk and limit the exploitation window. ### Source excerpt Learn how to move from static DevOps secrets to short-lived certificates and workload identity, securing CI/CD automation at scale with full audit visibility. ## Custom Certificates are now available in Custom Assembly DevFeed: [Custom Certificates are now available in Custom Assembly]() Original publisher: [Read original article]() Published: 2025-12-19T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard containers](), [Security](), [configuration](), [YAML](), [Containers]() Tags: [certificates](), [chainguard](), [chainguard-containers](), [chainguard-custom-assembly](), [chainguard-images](), [configuration](), [custom-assembly](), [custom-container-images](), [enterprise-certificate-authority-certificates](), [provenance](), [security](), [yaml]() ### AI overview Chainguard announces custom certificate support for Custom Assembly, allowing enterprise certificate authority certificates to be added directly to Chainguard Containers through image configuration. The certificates are validated, stored with the image configuration, appended to standard trust stores at build time, and included in image provenance. ### Source excerpt Custom Certificate support for Custom Assembly allows you to add your enterprise certificate authority certificates directly to Chainguard Containers ## HTTPS certificate industry phasing out less secure domain validation methods DevFeed: [HTTPS certificate industry phasing out less secure domain validation methods]() Original publisher: [Read original article]() Author: Google (noreply@blogger.com) Published: 2025-12-10T20:00:00Z Content type: article Language: en Sources: [Google Online Security]() Topics: [TLS (Transport Layer Security)](), [Security](), [Internet](), [Website]() Tags: [automation](), [certificates](), [internet](), [none](), [security](), [tls]() ### AI overview The Chrome Root Program and CA/Browser Forum are phasing out 11 legacy Domain Control Validation methods for HTTPS certificates. The change will be introduced gradually, with full implementation planned by March 2028, encouraging automated and cryptographically verifiable validation. ### Source excerpt Posted by Chrome Root Program Team Secure connections are the backbone of the modern web, but a certificate is only as trustworthy as the validation process and issuance practices behind it. Recently, the Chrome Root Program and the CA/Browser Forum have taken decisive steps toward a more secure internet by adopting new security requirements for HTTPS certificate issuers. These initiatives, driven by Ballots SC-080, SC-090, and SC-091, will sunset 11 legacy methods for Domain Control Validation. By retiring these outdated practices, which rely on weaker verification signals like physical mail, phone calls, or emails, we are closing potential loopholes for attackers and pushing the ecosystem toward automated, cryptographically verifiable security. To allow affected website operators to transition smoothly, the deprecation will be phased in, with its full security value realized by March 2028. This effort is a key part of our public roadmap, "Moving Forward, Together," launched in 2022. Our vision is to improve security by modernizing infrastructure and promoting agility through automation. While "Moving Forward, Together" sets the aspirational direction, the recent updates to the TLS Baseline Requirements turn that vision into policy. This builds on our momentum from earlier this year, including the successful advocacy for the adoption of other security enhancing initiatives as industry-wide standards. What's Domain Control Validation? Domain Control Validation is a security-critical process designed to ensure certificates are only issued to the legitimate domain operator. This prevents unauthorized entities from obtaining a certificate for a domain they do not control. Without this check, an attacker could obtain a valid certificate for a legitimate website and use it to impersonate that site or intercept web traffic. Before issuing a certificate, a Certification Authority (CA) must verify that the requestor legitimately controls the domain. Most modern validation r ## 10 reasons your CISO will love Temporal Cloud DevFeed: [10 reasons your CISO will love Temporal Cloud]() Original publisher: [Read original article]() Author: Tim Imkin Published: 2025-09-30T00:00:00Z Content type: opinion Language: en Sources: [Temporal Blog]() Topics: [Cloud](), [Security](), [Encryption](), [Firewall](), [Single sign-on (SSO)](), [Access Control](), [MFA](), [certificates](), [TLS (Transport Layer Security)](), [saml](), [ci](), [Serverless]() Tags: [access-control](), [api](), [api-keys](), [aws](), [certificates](), [ci](), [cloud](), [compliance](), [data](), [firewall](), [gdpr](), [google-cloud](), [mfa](), [network](), [permissions](), [soc](), [soc-2](), [temporal-concepts]() ### AI overview This article presents ten security and compliance characteristics of Temporal Cloud for CISO review. It describes client-side encryption with customer-controlled keys, outbound-only connectivity, mutual TLS, SAML SSO, RBAC, private connectivity options, secure debugging, and stated SOC 2, HIPAA, and GDPR support. ### Source excerpt Discover 10 reasons CISOs choose Temporal Cloud: no plaintext data, no inbound connectivity, mTLS with your CA, private links, SOC 2/HIPAA, secure debugging. [Next page]()