Readiness guides, kept current.
Not a blog. Each guide covers one change coming to the trust ecosystem, what it breaks, and a plan to get ahead of it. We revise them as the facts change and date each revision.
47-day certificates: a readiness guide
The CA/Browser Forum is cutting public TLS certificate lifetimes from 398 days to 47. Here is what changes, what it breaks, and a phased plan to be ready.
Last reviewed October 15, 2026
Read the guide →Post-quantum readiness for PKI and TLS
The post-quantum algorithms are standardized and the deprecation dates for RSA and ECC are published. Key exchange is migrating now. Signatures and PKI are the long, hard part. Here is how to sequence it.
Last reviewed October 15, 2026
Read the guide →Hardening Active Directory Certificate Services
Most AD CS deployments ship with template and CA settings that weaken domain security. Here is the hardening checklist: what to audit, how to fix each named weakness, and how to detect abuse.
Last reviewed October 15, 2026
Read the guide →Have a change you need to get ahead of?
Tell us what is coming at you. If we have not written it up yet, we will still have an opinion.