Tag: tls

REALITY does not disguise your traffic as a real TLS handshake, it serves an actual one. How that works, a working config, and the honest limits of the trick.

cert-manager makes Let's Encrypt automatic on Kubernetes, once. Then you scale, hit DNS-01 quirks, wildcard limits, and rate-limit walls. Here's the full survival guide.

Your reverse proxy only has the leaf cert, not the intermediate. Here's why that kills half your connections.

TLS tunneling for legacy plaintext services, stunnel's X.509 cert model vs spiped's pre-shared key simplicity, and when each one actually wins.

TLS 1.3 explained without the PhD: faster handshakes, better ciphers, and how to actually configure Nginx and Caddy to use it.

Certificate pinning and HPKP explained: what they are, why HPKP destroyed itself, and modern alternatives like CAA records and Certificate Transparency.

Mutual TLS (mTLS) explained for mortals: how both sides authenticate, setting up step-ca for internal PKI, generating client certs, and configuring nginx with mTLS.

Understand DoH, DoT, and DoQ encrypted DNS protocols and set up self-hosted encrypted DNS with AdGuard Home or Pi-hole. Stop your ISP from logging every domain you visit.

Advanced Caddy server configuration: wildcard certs, Caddyfile matchers, Docker label integration, rate limiting, forward auth with Authelia, and the JSON API.

Incomplete cert chains, wrong order, self-signed certs. How to diagnose trust failures with openssl s_client.

Certs expire silently. Check expiry with openssl, automate renewal checks with cron, get alerts before disaster.

Certificate pinning locks your app to a specific TLS cert so MITM attackers can't swap in a rogue CA, how it works and when to use it.