SSL/TLS Certificate Tools
Issuing, renewing, and configuring the certificates that make HTTPS work.
Directly related. Edge hosts obtain certificates via ACME (HTTP-01, DNS-01, wildcard) or from the cluster-local CA, and report certificate state in signed observations. This is verified against Pebble locally only -- never yet against a public CA.
How automated certificate issuance actually works
Let's Encrypt (and the ACME protocol it popularized) made TLS certificates free and automatable: a client proves it controls a domain -- usually by answering an HTTP challenge at a well-known path, or publishing a specific DNS TXT record -- and in exchange gets a short-lived certificate (Let's Encrypt's are valid ~90 days) that a tool like Traefik or Certbot renews automatically well before expiry. This replaced the older model of manually buying a certificate from a CA and installing it by hand.
Issuing, renewing, and configuring the certificates that make HTTPS work. Directly related. Edge hosts obtain certificates via ACME (HTTP-01, DNS-01, wildcard) or from the cluster-local CA, and report certificate state in signed observations. This is verified against Pebble locally only -- never yet against a public CA.