Tag: tls

Your reverse proxy only has the leaf cert, not the intermediate. Here's why that kills half your connections.

TLS tunneling for legacy plaintext services — stunnel's X.509 cert model vs spiped's pre-shared key simplicity, and when each one actually wins.

TLS 1.3 explained without the PhD: faster handshakes, better ciphers, and how to actually configure Nginx and Caddy to use it.

Certificate pinning and HPKP explained: what they are, why HPKP destroyed itself, and modern alternatives like CAA records and Certificate Transparency.

Mutual TLS (mTLS) explained for mortals: how both sides authenticate, setting up step-ca for internal PKI, generating client certs, and configuring nginx with mTLS.

Understand DoH, DoT, and DoQ encrypted DNS protocols and set up self-hosted encrypted DNS with AdGuard Home or Pi-hole. Stop your ISP from logging every domain you visit.

Advanced Caddy server configuration: wildcard certs, Caddyfile matchers, Docker label integration, rate limiting, forward auth with Authelia, and the JSON API.

Incomplete cert chains, wrong order, self-signed certs. How to diagnose trust failures with openssl s_client.

Certs expire silently. Check expiry with openssl, automate renewal checks with cron, get alerts before disaster.

Certificate pinning locks your app to a specific TLS cert so MITM attackers can't swap in a rogue CA — how it works and when to use it.