Tag: ssl

TLS 1.3 explained without the PhD: faster handshakes, better ciphers, and how to actually configure Nginx and Caddy to use it.

Certbot isn't the only ACME client. Explore Caddy, acme.sh, lego, and Step CA, with practical examples for wildcard certs and DNS-01 challenges.

Certificate pinning and HPKP explained: what they are, why HPKP destroyed itself, and modern alternatives like CAA records and Certificate Transparency.

Your proxy serves the leaf certificate and skips the intermediate, so half your clients fail. How to spot it, build the chain right, and keep renewals working.

Incomplete chains, bundles in the wrong order, and self-signed certs all read as untrusted. Diagnose with openssl s_client, then rebuild the chain properly.

Certificates expire silently and take the site with them. Check expiry with openssl, automate the check with cron or Uptime Kuma, and audit every cert.

Certificate pinning locks your app to a specific TLS cert so MITM attackers can't swap in a rogue CA, how it works and when to use it.

Get Caddy running as a reverse proxy in Docker, automatic HTTPS, Caddyfile config, and Docker Compose setup in under 10 minutes.