The CertIntel field notes
Field notes on TLS, PKI and certificate operations. Product updates and practical guidance for the people keeping infrastructure running.
Why Chrome, Windows, Firefox, OpenSSL, and PowerShell each show a different hash for the same certificate, what a fingerprint is computed over, how public key fingerprints differ, and when SHA-1 thumbprints are still safe to rely on.
How DNS Certification Authority Authorization records work under RFC 8659, what the issue, issuewild, and iodef tags mean, and how to publish and verify them without locking out your own renewals.
Why one CA key can lead to different trusted roots, how GoDaddy's R1-to-G2 cross certificate works, and what to look at when two clients disagree about the same certificate.
Why we built a certificate visibility platform with an agent that can see inside the network, and what it does and deliberately does not do.
