# certificates A digital certificate is signed data that identifies an entity and binds its public key to that entity for authentication and secure communications. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## CAA DNS Issuer-Critical Flags Are Confusing to Configure DevFeed: [CAA DNS Issuer-Critical Flags Are Confusing to Configure]() Original publisher: [Read original article]() Author: Remy Porter Published: 2026-09-10T06:30:00Z Content type: opinion Language: en Sources: [The Daily WTF]() Topics: [certificates](), [domain]() Tags: [bits](), [boolean](), [certificates](), [documentation](), [feature-articles](), [flag](), [https](), [readability]() ### AI overview The article examines confusion around the issuer-critical flag in DNS CAA records. It explains that the flag is defined as a bitmask, while many users interpret the documentation as requiring the integer 1 instead of the value representing the specified bit, creating a dilemma for certificate issuers such as LetsEncrypt. ### Source excerpt I'm not a DNS person, in that I appreciate that it exists but am not up on the inner workings. It solves a lot of problems with dark magic I don't fully understand, and fortunately don't need to. But Lucio noticed something that I do think is interesting, within the scope of the CAA record type. The CAA record started with RFC6844, which was obsoleted by RFC8659. Both RFCs lay out the same core idea: you can add a CAA record to your DNS entries to say, "hey, this domain over here is allowed to issue certificates for me". That's the sort of thing that enables LetsEncrypt to hand out certs, and is an important part of why we can run HTTPS everywhere these days. Now, RFC6844 has this in it: Issuer Critical: If set to '1', indicates that the corresponding property tag MUST be understood if the semantics of the CAA record are to be correctly interpreted by an issuer. Issuers MUST NOT issue certificates for a domain if the relevant CAA Resource Record set contains unknown property tags that have the Critical bit set. The issuer critical flag means that the certificate issuer needs to validate your CAA record before it issues a certificate for you. There's more in the RFC about what exactly that means, but we don't care about those details for right now. The rule here is "set a flag to 1". A little later in the RFC, the flag is described in more detail- as a bitmask. Specifically, bit 0 is the issuer critical flag. Bits 1-7 are reserved for future use. Now, here's where we get into trouble, because programmers don't understand bits, and because the CAA record expects you to put an integer in this field. So, if you want issuer critical enabled, what value to you put in this field? 128, obviously. That's 10000000. Except, if you don't understand bits, that's not obvious. A lot of people read this and decided that the documentation meant they needed to put 1 in the field- aka 00000001. This is wrong. The updated RFC tries to explain it a bit more clearly: Bit 0, Issuer Critic ## FIPS 140-2 vs FIPS 140-3, Explained DevFeed: [FIPS 140-2 vs FIPS 140-3, Explained]() Original publisher: [Read original article]() Author: info@goteleport.com (Mayur Pipaliya) Published: 2026-09-09T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [fips 140-3](), [FIPS validation](), [Cryptography](), [Encryption](), [certificates](), [Security](), [Cloud]() Tags: [certificates](), [cloud](), [cmvp](), [cryptography](), [encryption](), [fedramp](), [fips](), [fips-140-3](), [fips-validation](), [security](), [sensitive-data]() ### AI overview This article explains the differences between FIPS 140-2 and FIPS 140-3, including the standards' origins, CMVP validation certificates, applicable requirements for protecting sensitive data, and the transition timeline through September 2026. ### Source excerpt Understand key changes from FIPS 140-2 to FIPS 140-3. ## OpenAI's Ten Mathematical Results Tested Through Lean Certificates DevFeed: [OpenAI's Ten Mathematical Results Tested Through Lean Certificates]() Original publisher: [Read original article]() Published: 2026-08-01T00:00:00Z Content type: article Language: en Sources: [Alex Korbonits]() Topics: [Lean](), [OpenAI](), [certificates](), [trust](), [Artificial Intelligence]() Tags: [ai](), [certificates](), [openai](), [paper](), [trust]() ### AI overview The article examines OpenAI's release of ten results on long-standing mathematical problems and reports independently building and checking the accompanying Lean certificates. It says all 38 headline theorems passed with no errors or non-standard axioms, while raising concerns about trusting definitions written by the same system that produced the proofs. ### Source excerpt OpenAI shipped ten open problems with Lean certificates. I built all 550,000 lines and checked what they rest on. Everything passed -- and the only thing left to trust is 1,700 lines of definitions written by the same system that wrote the proofs. ## How to import multiple iOS signing certificates to CI DevFeed: [How to import multiple iOS signing certificates to CI]() Original publisher: [Read original article]() Author: Marco Gomiero Published: 2026-07-02T00:00:00Z Content type: tutorial Language: en Sources: [Posts on Marco Gomiero]() Topics: [GitHub Actions](), [certificates](), [iOS](), [ci]() Tags: [app-store](), [apple](), [certificates](), [ci](), [distribution](), [github](), [github-actions](), [how-to](), [ios](), [secrets](), [signing]() ### AI overview A tutorial explaining how to export multiple iOS signing certificates, combine them into a certificate file, encode it with base64, and store it as a GitHub secret for use in GitHub Actions. ### Source excerpt Some time ago, I shared the GitHub Actions workflow that I use for deploying the iOS version of FeedFlow to the App Store. How to publish a Kotlin Multiplatform iOS app on App Store with GitHub Actions One step of that CI job is setting up the required certificates for signing the app: Apple Development and Apple Distribution. In the past, it was possible to extract these two certificates from the local Keychain by selecting them and using the Export 2 items... option. ## Post-Quantum Certificates DevFeed: [Post-Quantum Certificates]() Original publisher: [Read original article]() Published: 2026-06-27T16:17:41Z Content type: article Language: en Sources: [Signs of Triviality]() Topics: [certificates](), [Post-Quantum](), [TLS (Transport Layer Security)](), [Web]() Tags: [2026](), [certificates](), [post-quantum](), [tls](), [web]() ### AI overview A summary of post-quantum certificates and the TLS and web-PKI ecosystem as of June 2026. ### Source excerpt A summary of post-quantum certificates and the TLS / web-PKI ecosystem as of June 2026. ## How to Eliminate Shared Database Passwords: MySQL, PostgreSQL, and More DevFeed: [How to Eliminate Shared Database Passwords: MySQL, PostgreSQL, and More]() Original publisher: [Read original article]() Author: info@goteleport.com (Dan Johns) Published: 2026-06-05T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Databases](), [MySQL](), [PostgreSQL](), [certificates](), [passwords](), [Single sign-on (SSO)](), [audit](), [Authorization]() Tags: [apply](), [audit](), [certificates](), [credentials](), [cryptographic](), [database](), [how-to](), [mysql](), [passwords](), [permissions](), [policy](), [postgresql](), [sso]() ### AI overview A guide to replacing shared database passwords and standing privileges with short-lived certificates and identity-based access. It explains how Teleport supports MySQL, PostgreSQL, and other databases, including role-based permissions, hardware-key approval for writes, and query-level attribution in audit logs. ### Source excerpt Learn how to access MySQL, PostgreSQL, and other databases using short-lived certificates instead of shared passwords. ## How to Extend SPIFFE Beyond Kubernetes: Bring Zero Trust Identity to Your VMs DevFeed: [How to Extend SPIFFE Beyond Kubernetes: Bring Zero Trust Identity to Your VMs]() Original publisher: [Read original article]() Author: info@goteleport.com (Jeffrey Ellin) Published: 2026-05-21T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [SPIFFE](), [Zero Trust](), [certificates](), [istio](), [Kubernetes]() Tags: [api](), [certificates](), [istio](), [kubernetes](), [mesh](), [spiffe](), [zero-trust]() ### AI overview This tutorial explains how to extend SPIFFE-based zero-trust workload identity beyond Kubernetes to VMs, edge gateways, and legacy services. It describes separating identity issuance from consumption, using short-lived identities through a local API, with Envoy consuming identity via SDS and Teleport managing the trust chain. ### Source excerpt Discover how Envoy + SDS and Teleport Workload Identity let off-cluster workloads securely call Istio services without distributing certificates. ## Guide: How to Unify Identity Across Cloud and Data Center Infrastructure DevFeed: [Guide: How to Unify Identity Across Cloud and Data Center Infrastructure]() Original publisher: [Read original article]() Author: info@goteleport.com (Mayur Pipaliya) Published: 2026-05-01T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [IAM](), [trust](), [certificates](), [SPIFFE](), [Cloud](), [data centers](), [Amazon Web Services](), [Entra ID]() Tags: [certificates](), [cloud](), [critical-infrastructure](), [data-center](), [entra-id](), [identity](), [identity-and-access](), [infrastructure](), [spiffe]() ### AI overview This guide explains identity fragmentation across cloud accounts, data centers, and colocated infrastructure. It describes siloed identity systems, credential sprawl, and differing access models, and presents approaches including hardware roots of trust, short-lived certificates, shared certificate authorities, SPIFFE workload identities, reverse tunnels, and protocol-level enforcement. ### Source excerpt Inside this guide, discover the root causes of identity fragmentation across cloud and data center environments -- and what it takes to unify identity. ## CockroachDB Plans Native X.509 SAN Support for SPIFFE and SPIRE Integration DevFeed: [CockroachDB Plans Native X.509 SAN Support for SPIFFE and SPIRE Integration]() Original publisher: [Read original article]() Author: Sanchit Khanna,Biplav Saraf Published: 2026-03-13T00:00:00Z Content type: article Language: en Sources: [Cockroach Labs]() Topics: [CockroachDB](), [Databases](), [SPIFFE](), [SPIRE](), [certificates](), [Zero Trust](), [Security](), [Microservice]() Tags: [architectures](), [auditability](), [aws-iam](), [certificates](), [cockroachdb](), [compliance](), [cryptographic](), [database](), [distributed](), [processor](), [regex](), [security](), [soc](), [soc-2](), [spiffe](), [spire](), [standards](), [teams](), [verification](), [zero-trust]() ### AI overview The article previews planned CockroachDB authentication support for Subject Alternative Name fields in X.509 certificates. It explains how SAN support is intended to enable integration with SPIFFE and SPIRE and support regex-based identity mapping for cloud-native workloads. ### Source excerpt In the evolution of cloud-native security, identity has become the new perimeter. ## Preparing for Shorter SSL/TLS Certificate Lifetimes DevFeed: [Preparing for Shorter SSL/TLS Certificate Lifetimes]() Original publisher: [Read original article]() Author: Emily Huang Published: 2026-03-06T16:50:10Z Content type: article Language: en Sources: [Heroku]() Topics: [Heroku](), [TLS (Transport Layer Security)](), [certificates](), [AWS Certificate Manager](), [maintenance](), [Security]() Tags: [automation](), [certificates](), [heroku](), [maintenance](), [news](), [security](), [ssl](), [tls]() ### AI overview Heroku explains that publicly trusted SSL/TLS certificates will have shorter maximum lifetimes, with a 200-day maximum beginning March 15, 2026. Users who manually manage certificates for Heroku applications will need more frequent renewals, while Heroku Automated Certificate Management handles certificate renewal automatically. ### Source excerpt The web browser and certificate authority industry is shortening the maximum allowed lifetime of TLS certificates. These changes will improve security on the Web, but you may have to change certificate maintenance practices for apps you run on Heroku. The good news is that if you're using Heroku Automated Certificate Management, no changes are required: [...] The post Preparing for Shorter SSL/TLS Certificate Lifetimes appeared first on Heroku. ## How to Secure Microservices with SPIFFE and Istio DevFeed: [How to Secure Microservices with SPIFFE and Istio]() Original publisher: [Read original article]() Author: info@goteleport.com (Jeff Ellin, Boris Kurktchiev) Published: 2026-02-20T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [istio](), [Microservices](), [SPIFFE](), [Zero Trust](), [Authorization](), [Architecture & Design](), [Secrets Management](), [certificates]() Tags: [architecture](), [authorization](), [backend](), [certificates](), [cloud-native](), [firewalls](), [how-to](), [istio](), [kubernetes](), [microservices](), [policies](), [secrets-management](), [security](), [service-mesh](), [spiffe](), [zero-trust]() ### AI overview This guide explains how to secure microservices with SPIFFE identities, Istio service-mesh mTLS, short-lived certificates, and Zero Trust authorization policies. It addresses the limits of network-based trust and long-lived certificates in dynamic Kubernetes environments. ### Source excerpt Learn how to deploy a secure microservices application, configure default-deny authorization policies, and rebuild service connectivity with SPIFFE-based allow rules. ## DevOps Credential Hygiene: How to Eliminate CI/CD Secrets with Teleport DevFeed: [DevOps Credential Hygiene: How to Eliminate CI/CD Secrets with Teleport]() Original publisher: [Read original article]() Author: meina.ghafouri@goteleport.com (Meina Ghafouri) Published: 2025-12-22T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [DevOps](), [CI/CD](), [certificates](), [Security](), [audit]() Tags: [api-keys](), [certificates](), [ci-cd](), [devops](), [environment-variables](), [passwords](), [private-key](), [secrets](), [security]() ### AI overview This tutorial explains the risks of static credentials in DevOps and CI/CD pipelines, including difficult rotation and broad exposure across infrastructure. It presents short-lived certificates and workload identity as ways to reduce risk and limit the exploitation window. ### Source excerpt Learn how to move from static DevOps secrets to short-lived certificates and workload identity, securing CI/CD automation at scale with full audit visibility. ## 10 reasons your CISO will love Temporal Cloud DevFeed: [10 reasons your CISO will love Temporal Cloud]() Original publisher: [Read original article]() Author: Tim Imkin Published: 2025-09-30T00:00:00Z Content type: opinion Language: en Sources: [Temporal Blog]() Topics: [Cloud](), [Security](), [Encryption](), [Firewall](), [Single sign-on (SSO)](), [Access Control](), [MFA](), [certificates](), [TLS (Transport Layer Security)](), [saml](), [ci](), [Serverless]() Tags: [access-control](), [api](), [api-keys](), [aws](), [certificates](), [ci](), [cloud](), [compliance](), [data](), [firewall](), [gdpr](), [google-cloud](), [mfa](), [network](), [permissions](), [soc](), [soc-2](), [temporal-concepts]() ### AI overview This article presents ten security and compliance characteristics of Temporal Cloud for CISO review. It describes client-side encryption with customer-controlled keys, outbound-only connectivity, mutual TLS, SAML SSO, RBAC, private connectivity options, secure debugging, and stated SOC 2, HIPAA, and GDPR support. ### Source excerpt Discover 10 reasons CISOs choose Temporal Cloud: no plaintext data, no inbound connectivity, mTLS with your CA, private links, SOC 2/HIPAA, secure debugging. ## TLS Certificate Cheat Sheet - OpenSSL & Curl DevFeed: [TLS Certificate Cheat Sheet - OpenSSL & Curl]() Original publisher: [Read original article]() Author: Chris Hager Published: 2025-09-22T00:00:00Z Content type: tutorial Language: en Sources: [Chris Hager]() Topics: [TLS (Transport Layer Security)](), [certificates](), [Cheat sheet](), [openssl](), [cURL]() Tags: [certificates](), [cheat-sheet](), [curl](), [openssl](), [tls](), [tools]() ### AI overview A cheat sheet for creating, inspecting, signing, validating, and testing TLS certificates and related keys and CSRs using OpenSSL and cURL. ### Source excerpt https://collective.flashbots.net/t/tls-certificates-know-how-quick-reference/5292 ## Enabling platform engineering with Temporal: Five practical use cases DevFeed: [Enabling platform engineering with Temporal: Five practical use cases]() Original publisher: [Read original article]() Author: Cornelia Davis Published: 2025-08-13T00:00:00Z Content type: tutorial Language: en Sources: [Temporal Blog]() Topics: [Platform Engineering](), [Automation](), [incident](), [Incident response](), [certificates](), [Kubernetes](), [CI/CD](), [datadog]() Tags: [certificates](), [ci-cd](), [datadog](), [engineering](), [how-to](), [idp](), [incident](), [incident-response](), [infrastructure](), [kubernetes](), [platform](), [platform-engineering]() ### AI overview This article presents five practical use cases for using Temporal to automate platform engineering workflows, including incident response, certificate rotation, infrastructure management, CI/CD, and internal developer platform workflows. It explains how fault-tolerant workflows can replace fragile scripts and manual processes with durable automation, human approvals, handoffs, and auditable execution. ### Source excerpt Learn how platform engineering teams automate incident response, certificate rotation, infrastructure management, CI/CD, and IDP workflows with Temporal. ## Zero-Trust Access for GitHub DevFeed: [Zero-Trust Access for GitHub]() Original publisher: [Read original article]() Author: ben@goteleport.com (Ben Arent) Published: 2025-02-20T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [GitHub](), [Zero Trust](), [MFA](), [Security](), [Authentication](), [certificates](), [audit](), [Logging](), [okta](), [Entra ID]() Tags: [audit](), [authentication](), [certificates](), [github](), [idp](), [logging](), [mfa](), [okta](), [security](), [terraform](), [zero-trust]() ### AI overview The article explains Teleport's approach to securing GitHub repositories with zero-trust access. It describes risks from SSH keys, personal access tokens, and identity-provider compromise, and presents hardware MFA, short-lived certificates, and audit logging as part of a defense-in-depth model. ### Source excerpt Learn how to secure GitHub repos with zero-trust principles using Teleport's GitHub Proxy Support, hardware MFA, short-lived certificates, and audit logging. ## How to provision certificates for internal services with Teleport Workload Identity DevFeed: [How to provision certificates for internal services with Teleport Workload Identity]() Original publisher: [Read original article]() Author: noah@goteleport.com (Noah Stride) Published: 2025-02-18T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [certificates](), [TLS (Transport Layer Security)](), [TLS handshake](), [Encryption](), [Cryptography](), [trust](), [Authentication](), [Authorization](), [Networks]() Tags: [authentication](), [authorization](), [certificates](), [cryptography](), [encryption](), [networks](), [tls](), [tls-handshake](), [trust](), [x509]() ### AI overview This tutorial explains how to provision X.509 certificates for internal services with Teleport Workload Identity. It covers TLS, mutual TLS, certificate authorities, workload identity, and the role of certificates in authenticating services and securing internal traffic. ### Source excerpt Learn how to securely provision X509 certificates to secure traffic between internal services using mTLS and Teleport Workload Identity. ## Four Ways Teleport Overcomes the Limitations of VPNs and Bastions DevFeed: [Four Ways Teleport Overcomes the Limitations of VPNs and Bastions]() Original publisher: [Read original article]() Author: eglenn@goteleport.com (Eddie Glenn) Published: 2025-01-27T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Security](), [Virtual Private Network](), [Networks](), [Cloud](), [Scalability](), [Zero Trust](), [legacy](), [certificates]() Tags: [bastion-host](), [certificates](), [cloud](), [cloud-native](), [containers](), [networks](), [passwords](), [scalability](), [security](), [serverless](), [vpn](), [vulnerabilities](), [zero-trust]() ### AI overview This Teleport blog article describes limitations of VPNs and bastion hosts in modern cloud-native and distributed environments, including scalability, maintenance, credential management, security, and compliance challenges. It presents Teleport's credential-less, ephemeral access as the proposed alternative. ### Source excerpt Discover how Teleport overcomes VPN and bastion host limitations with zero trust principles, ephemeral certificates, and seamless access that improves security. ## How to use Teleport Machine ID to provide database access to applications running on EKS without passwords DevFeed: [How to use Teleport Machine ID to provide database access to applications running on EKS without passwords]() Original publisher: [Read original article]() Author: info@goteleport.com (Gavin Frazar) Published: 2024-12-03T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Amazon EKS](), [Kubernetes](), [PostgreSQL](), [Authorization](), [AWS Fargate](), [certificates](), [Access Control](), [Amazon Elastic Container Service](), [TLS (Transport Layer Security)](), [AWS IAM](), [container](), [VPC]() Tags: [access-control](), [api-keys](), [aws-fargate](), [aws-iam](), [certificates](), [container](), [ecs](), [how-to](), [kubernetes](), [passwords](), [postgresql](), [secrets](), [tls](), [vpc]() ### AI overview A tutorial on deploying Temporal on Amazon EKS so it can connect to an AWS RDS PostgreSQL database without passwords or other shared secrets. It uses Teleport Machine & Workload Identity, a sidecar, short-lived X.509 certificates, PostgreSQL role provisioning, and a Teleport Database Service deployed on AWS Fargate. ### Source excerpt Discover how to secure database access in Kubernetes workloads. Eliminate secrets, keep databases in private networks, and improve audit logging with Teleport. ## One timezone for everything: k8tz and the Jakarta timestamp problem DevFeed: [One timezone for everything: k8tz and the Jakarta timestamp problem]() Original publisher: [Read original article]() Published: 2024-11-20T00:00:00Z Content type: article Language: en Sources: [Andika Ahmad Ramadhan -- Blog]() Topics: [Kubernetes admission controller](), [timezone](), [certificates](), [TLS (Transport Layer Security)](), [elasticsearch]() Tags: [certificates](), [elasticsearch](), [kubernetes-admission-controller](), [timezone](), [tls]() ### AI overview The article explains how k8tz applies Asia/Jakarta to Kubernetes pods through an admission controller, allowing public images such as Fluentd and Elasticsearch to use the platform timezone without image changes. It also describes three upstream patches for cert-manager support, certificate rotation without restarts, and configurable initContainer names. ### Source excerpt How we used k8tz to force Asia/Jakarta onto public images like Fluentd and Elasticsearch, and the three patches I sent upstream. ## Using Let's Encrypt Certificates with Temporal Cloud DevFeed: [Using Let's Encrypt Certificates with Temporal Cloud]() Original publisher: [Read original article]() Author: Mike Delago Published: 2024-10-03T21:47:50Z Content type: tutorial Language: en Sources: [Apartment 304]() Topics: [TLS (Transport Layer Security)](), [let's encrypt](), [certificates]() Tags: [apartment-304](), [certificates](), [custom-software-solutions](), [devops](), [devops-engineer](), [let-s-encrypt](), [software-architecture](), [software-development](), [software-engineer](), [tls]() ### AI overview A tutorial for configuring Temporal Cloud to use certificates from Let's Encrypt or another well-known certificate authority. It explains obtaining the CA certificate chain and adding it with certificate filters in Temporal Cloud namespace settings. ### Source excerpt A not-so-scary serving of the horrors of x.509 certificate management. ## Heroku ACM Adds Wildcard Domain Support for the Common Runtime DevFeed: [Heroku ACM Adds Wildcard Domain Support for the Common Runtime]() Original publisher: [Read original article]() Author: Ethan Limchayseng Published: 2024-09-27T03:09:00Z Content type: release Language: en Sources: [Heroku]() Topics: [Heroku](), [cloud security](), [certificates](), [Cloud]() Tags: [announce](), [certificates](), [cloud-infrastructure](), [cloud-security](), [heroku](), [https](), [news](), [product-features](), [security]() ### AI overview Heroku Automated Certificate Management now supports wildcard domains for the Common Runtime, allowing one wildcard certificate to cover multiple subdomains. Heroku ACM handles certificate issuance, renewal, and management. ### Source excerpt We are thrilled to announce that Heroku Automated Certificate Management (ACM) now supports wildcard domains for the Common Runtime! Heroku ACM's support for wildcard domains streamlines your cloud management by allowing Heroku's Certificate management to cover all your desired subdomains with only one command, reducing networking setup overhead and providing more flexibility while enhancing the [...] The post Simplify Your Cloud Security: Heroku ACM Now Supports Wildcard Domains appeared first on Heroku. ## How To Detect Compromised Identities with Teleport DevFeed: [How To Detect Compromised Identities with Teleport]() Original publisher: [Read original article]() Author: info@goteleport.com (Szymon Drosdzol, Doyensec Security, Aleksandr Klizhentas, Teleport Platform Security) Published: 2024-05-03T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Monitoring](), [Access Control](), [Authorization](), [certificates](), [systems]() Tags: [access-control](), [article](), [hardening](), [how-to](), [identity](), [monitoring](), [time]() ### AI overview This tutorial explains how to use Teleport to detect impersonators and compromised identities. It describes heuristic detection based on abnormal employee behavior, monitoring interactions with resources, querying access events, and using hardening mechanisms to limit the potential damage caused by malicious insiders. ### Source excerpt Using Teleport to detect impersonators and compromised identities ## Exploring Temporal Cloud automation features DevFeed: [Exploring Temporal Cloud automation features]() Original publisher: [Read original article]() Author: Irina Belova Published: 2024-03-25T06:00:00Z Content type: article Language: en Sources: [Temporal Blog]() Topics: [Automation](), [Cloud](), [terraform provider](), [API](), [Infrastructure as code](), [API keys](), [certificates](), [Security](), [Authentication](), [Command-line interface](), [Kubernetes]() Tags: [api](), [api-keys](), [automation](), [certificates](), [cli](), [cloud](), [infrastructure-as-code](), [mtls](), [organizations](), [platform-teams](), [provisioning](), [security](), [temporal](), [temporal-concepts](), [terraform-provider]() ### AI overview Temporal Cloud's automation features support management of namespaces, users, access, account settings, and team onboarding. The article also describes API, Terraform provider, and Temporal Cloud CLI integrations, including automated mTLS certificate rotation and centralized governance for platform teams. ### Source excerpt Temporal Cloud Automation capabilities are transforming the way companies deploy, manage, and scale their operations in the Cloud. [Next page]()