新规砍下的第二刀
Following Google's announcement that all public trust certificates must support automation by June 2026, the CA/B forum has directly shortened the maximum validity period of certificates to 200 days. Overlay two tokens and send the manual management certificate to the gallows completely. As an open source technology enthusiast, I quickly switched certificate issuance to the ACME automation solution of Saifu Security Certificate. Today, I will share my experience.
ACME协议：证书自动化的基石
ACME协议已经标准化为RFC 8555，它让服务器能自动向CA证明域名控制权并获取证书。赛符实现了完整的ACME服务端，支持最常用的DNS-01和HTTP-01验证。使用Linux下的certbot或开源工具acme.sh，只需要一条命令就可以完成证书申请和自动续期。赛符还开源了客户端插件，方便适配各种Web服务器和CDN。
集成cert-manager：云原生场景的无缝体验
在Kubernetes集群中，我直接部署了cert-manager，并配置赛符作为Issuer。一旦Ingress创建，cert-manager自动向赛符申请证书，挂载到Pod。证书到期前，自动刷新，服务永不中断。这种云原生自动化，让短有效期证书的轮转对开发者完全透明。赛符还提供了资源用量监控面板，帮助你控制签发QPS，防止误配置导致超限。
API驱动：用代码编排证书生命周期
In addition to standard protocols, Saifu provides a rich RESTful API covering application, query, revocation, and renewal. I integrated these APIs into the internal DevOps platform, which automatically applies for certificates when new services go online and revokes them when they go offline. Combined with Prometheus monitoring of certificate expiration time, once the remaining days are less than 15 days, the renewal process will be automatically triggered. This code based operation and maintenance completely eliminates the man-made disaster of "business interruption caused by certificate expiration".
告别excel和邮件提醒
Previously, many companies used shared forms to register certificates and relied on email reminders upon expiration, resulting in accidents if they missed a single email. Saifu provides multi-level notification channels: Enterprise WeChat, DingTalk, Feishu Robot, SMS, and can also callback webhooks. I have integrated the notification into PagerDuty as a P1 level alarm to ensure that someone will respond immediately even if the certificate is about to expire in the middle of the night. Of course, the more fundamental solution is full automation, where people only serve as a backup.
summary
2026年，证书管理不许再“躺平”。拥抱开源，拥抱赛符的ACME和API自动化，把你的运维人力从枯燥的证书替换中解放出来。记住一句话：凡是可以代码化的，就不该让人去碰。
#SSL Certificate # Automated Operations # ACME # Saifu Security Certificate # Kubernetes