It uses Let's Encrypt by default. We use delegated DNS to handle ACME challenge validation (we run the DNS, you just CNAME to us). This means you don't need to give us DNS credentials or anything. And for HA workloads it's great, because there's a central clearinghouse for certificates - so all the machines in your web farm (or whatever) get the same cert, but you don't run in to rate limits with LE.

We're recovering Windows Server guys so we made sure our automation works for painful windows workloads like IIS, Exchange etc. too.

We've had enough interest that we're building it out for real. Just left beta last month.

Certbot is the obvious answer but it doesn’t cover everything. It requires ACME on each server, which means each server needs to be internet-reachable or have DNS provider access. That rules out Windows servers, JKS keystores, and appliances that can’t run Certbot or speak ACME at all.

CertKit handles ACME centrally. A source-available Go agent runs on each server and handles deployment, including Windows, JKS, and appliances via custom file destinations and post-deploy commands. Validation uses a delegated CNAME so we never need your DNS provider credentials.

We just wrapped up our beta and launched today. Happy to answer any questions.

https://www.certkit.io/

Comments URL: https://news.ycombinator.com/item?id=47690037

Points: 7

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=47152349

Points: 6

# Comments: 0

That said, crt.sh can be woefully unreliable. It often returns errors during a query or is just hard down. Large result sets may never return. Queries often take a very long time.

I wanted a more reliable CT log search tool for something I'm working on, so I built a purpose built CT log search tool. I ingest all the data from the logs directly and store in Clickhouse.

https://www.certkit.io/tools/ct-logs/

The goal was to show the high level change, in a glanceable way, not to get in to individual millisecond comparisons. However, in the future I would pick a different visualization I think :)

The benchmarking has also come under fire. My goal was to just to put the same site/assets on three different continents and retrieve them a bunch of times. No more, no less. I think the results are still interesting, personally. Clean room benchmarks are cool, but so are real world tests, imo.

Finally, there was no agenda with this post to push HTTP/3 over HTTP/2. I was actually skeptical that HTTP/3 made any kind of difference based on my experience with 1.1 to 2. I expected to write a post about "HTTP/3 is not any better than HTTP/2" and was frankly surprised that it was so much faster in my tests.

Lots of room for improvement next time I think.

(We've been around since 2014, so we pre-date them by 4 years)

[1] https://trackjs.com

It's hosted on Github Pages so hopefully it's available:

https://requestmetrics.com/

Comments URL: https://news.ycombinator.com/item?id=17810632

Points: 1

# Comments: 0