{"id":94304,"date":"2026-09-10T13:27:17","date_gmt":"2026-09-10T11:27:17","guid":{"rendered":"https:\/\/www.skaylink.com\/?p=94304"},"modified":"2026-09-23T10:51:43","modified_gmt":"2026-09-23T08:51:43","slug":"an-end-to-certificate-chaos","status":"publish","type":"post","link":"https:\/\/www.skaylink.com\/en\/insights\/blog\/an-end-to-certificate-chaos\/","title":{"rendered":"An end to certificate chaos"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Home<\/a><\/span><\/span><\/p>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Blog<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

An end to certificate chaos<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tWhy a Windows-only PKI is not enough, and how automated certificate management with ACME improves security and operations.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tSeptember 10, 2026\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\n\t\t\t\t\t\t\tHenry Schleichardt\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Principal Consultant<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\n\t\t\t\t\t\t\tStefan Wei\u00df\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Consultant<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Why a Windows PKI is no longer enough<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Anyone running a Microsoft-only environment relies on the Windows Public Key Infrastructure (PKI). This is secure and efficient as long as you stay within the boundaries of Active Directory. In practice, however, a purely Windows-based infrastructure is rare. What happens on the edges of these infrastructures?<\/p>\n

For Linux servers, firewalls, load balancers, or container platforms, it is not possible to automatically access certificates from the Windows environment. This creates a security vulnerability that administrators can often resolve only with considerable manual effort.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Why we need certificates<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In today\u2019s modern security architectures, the \u201czero trust\u201d principle applies. Certificates are required at an increasing number of endpoints to ensure secure and encrypted communication.<\/p>\n

Certificates can be obtained automatically via the Automated Certificate Management Environment (ACME) protocol from providers such as Actalis SSL or Let\u2019s Encrypt. It is crucial that validation of the resource in question can be performed by an external authority, a certification body, via the Internet. This requires that the resource\u2019s name be resolvable on the Internet so that the verification can be performed successfully.<\/p>\n

And right there lies the real challenge: Without a publicly accessible and routable domain for internal endpoints, it is not possible to automatically issue certificates via ACME for internal systems.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

The trap of manual management and short-lived certificates<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

For many administrators, the reality is harsh: They often have to manually request certificates for systems that are not accessible from the outside, copy them, and distribute them to the systems.<\/p>\n

The risks of manual allocation<\/h5>\n
    \n
  • Human error<\/strong>: A certificate expires because the calendar reminder entry was missing or was overlooked. As a result, critical services are unavailable, and troubleshooting can take several hours under some circumstances.<\/li>\n
  • Long validity periods<\/strong>: To minimize administrative burdens, certificates are often issued with terms of more than one\u00a0year. From a security standpoint, this is a cause for concern: The longer the validity period, the greater the window of opportunity for potential misuse of compromised keys.<\/li>\n<\/ul>\n

    Most browsers now only accept certificates with a validity period of about one\u00a0year. In fact, the trend is clearly moving toward even shorter validity periods \u2013 like with Let\u2019s Encrypt, where certificates are currently valid for only 90\u00a0days. But having to manually renew certificates every 90\u00a0days puts the brakes on your IT department. The administrative burden is enormous.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t

    The solution: A single web service for all systems<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    A central ACME service, operated as a web service on the internal network, provides a solution. It enables the distribution of certificates to all clients. The strength of this web service is its flexibility. Since the ACME protocol is an open standard, there are ready-made clients available for almost every system. It doesn\u2019t matter at all whether it\u2019s a KEMP or Fortinet firewall, a Docker container, or a Windows server without an Active Directory connection.<\/p>\n

    The advantages:<\/h5>\n
      \n
    • Universal compatibility via Windows and beyond<\/strong>: While Windows PKI excludes all clients that do not support Kerberos authentication, this service enables the fully automated provisioning of certificates to all systems on the network.<\/li>\n
    • Increased security through a short validity period<\/strong>: Modern security standards, such as short-validity certificates, can be easily implemented internally, since the renewal process runs automatically in the background.<\/li>\n
    • Preventing outages<\/strong>: The risk of human error is eliminated by the higher degree of automation. This significantly improves the operational stability of the services.<\/li>\n
    • Standardization<\/strong>:\u00a0Using a standardized protocol across different manufacturers and operating systems makes it easier to diagnose errors.<\/li>\n<\/ul>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

      Why a Windows-only PKI is not enough, and how automated certificate management with ACME improves security and operations.<\/p>\n","protected":false},"author":34,"featured_media":91917,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[100],"tags":[],"class_list":["post-94304","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/posts\/94304","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/users\/34"}],"replies":[{"embeddable":true,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/comments?post=94304"}],"version-history":[{"count":9,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/posts\/94304\/revisions"}],"predecessor-version":[{"id":94609,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/posts\/94304\/revisions\/94609"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/media\/91917"}],"wp:attachment":[{"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/media?parent=94304"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/categories?post=94304"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.skaylink.com\/en\/wp-json\/wp\/v2\/tags?post=94304"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}