Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Automatic Certificates with Let's Encrypt and ACME: Certbot, Nginx, Wildcards and Renewal with ARI
Getting a certificate with ACME takes account, order, authorization, challenge and finalize steps; Certbot does it on Nginx with webroot or the nginx plugin, gets wildcards with DNS-01, and thanks to ARI renews when the CA suggests. With real runs on Pebble we watch a revoked certificate renew itself through ARI, and look at profiles, 6-day and IP certificates, and the cost of closing port 80.
The Certificate Lifecycle: CSR, Domain Validation, Certificate Transparency, Revocation and the 47-Day Future
A certificate is requested with a CSR, the CA validates the domain with HTTP-01, DNS-01 or TLS-ALPN-01, the certificate is written to CT logs, and revocation now rests on CRLs and short lifetimes rather than OCSP. With SC-081v3 the maximum lifetime drops to 200 days on 15 March 2026, 100 in 2027 and 47 in 2029; through crt.sh, a real CRL and CSR generation in .NET we see why manual renewal is over.