Certificate replacements after CA distrust may take weeks

An analysis of Certificate Transparency logs reveals that replacing tens of thousands of certificates after a certificate authority distrust could take weeks due to default order limits. While 99.4% of domains have fewer than 30 certificates and can migrate quickly, large platforms and organizations with tens of thousands of certificates face significant operational hurdles. The author argues that organizations managing massive infrastructure must automate issuance and proactively request rate-limit overrides to prepare for emergency migrations. Open article →