MLabs Publications
The many minds at MLabs present news, case studies, editorials, tutorials, whitepapers, Cardano Catalyst proposals, and more.
Your certificates expire on the earliest date in their chain
Two leaf certificates with 25 days left failed when their intermediate CA expired. How to find your chain's real expiry, and why a broken chain hides it.
Most certificate lifecycle management is free. The part that costs money was never a tool.
ACME clients, CT-log monitors, expiry monitors, discovery tools and enterprise CLM platforms each answer a different question. Most teams need the free ones. None of them assigns an owner to an internal CA, an appliance or an mTLS certificate.
By 2029 every public TLS certificate renews 7.77 times a year, and a calendar can't keep up
The CA/Browser Forum SC-081v3 schedule, dated: 200 days from 15 March 2026, 100 from 15 March 2027, 47 from 15 March 2029, with renewals per certificate per year at each step and why calendar reminders stop working at 100 days.
Shorter certificate lifetimes will not break your public TLS. They will break the certificates nobody owns.
The CA/Browser Forum cut maximum TLS lifetimes to 47 days by March 2029. Public TLS is the easy half. The certificates that break first are the internal CA, appliance, mTLS and vendor-console certificates with no named owner.
From Bugs to Breakthroughs: Auditing Cardano Smart Contracts
In this post, we unpack how Cardano smart contracts go wrong and why audits are key to preventing hard-to-fix or irreversible issues. Learn eUTxO-specific pitfalls like multiple satisfaction, plus what to prepare so an audit surfaces real issues fast.