Author name: CrtMgr Team

MongoDB running without TLS sends documents, queries, and authentication tokens over the network in plaintext. This is the default for self-managed MongoDB, even on versions 5, 6, and 7. This article walks through enabling TLS on mongod, connecting the mongo shell and drivers with certificate verification, enabling mutual TLS for x.509 client authentication, and configuring

MySQL and MariaDB both generate self-signed TLS certificates automatically during installation, but they do not require clients to use them. The default setup allows plaintext connections to coexist with TLS connections — clients that do not ask for TLS get none. This article shows how to verify that TLS is working, replace the auto-generated certificates

Nextcloud running over HTTP is a serious risk for a file storage application — your login credentials, file contents, and share links all travel in plaintext. But enabling HTTPS on Nextcloud involves more than just installing a certificate on the web server. Nextcloud generates URLs internally and needs to know it is behind HTTPS, or

Nginx Proxy Manager (NPM) is a web-based GUI for nginx reverse proxy configuration. It manages SSL certificates through a visual interface, which makes it accessible to administrators who are not comfortable editing nginx configuration files directly. This article covers setting up Let’s Encrypt certificates in NPM, uploading custom certificates, configuring advanced TLS settings, and understanding

pgAdmin 4 in server mode runs an internal web server (Gunicorn or built-in). By default that web server listens on HTTP — any credentials you type into the pgAdmin login form, any database passwords, any SQL you execute all travel in plaintext if you access pgAdmin over a network. This article covers enabling HTTPS on

phpMyAdmin is one of the most targeted web applications on the internet — attack scanners look for it at dozens of common URL paths, and if they find it running over HTTP, they can harvest MySQL credentials from network traffic or from browser history in shared environments. This article covers deploying phpMyAdmin behind nginx with

Proxmox VE ships with a self-signed certificate. The browser warning it produces is not just an annoyance — users clicking through “Your connection is not private” warnings train themselves to ignore certificate errors, which is dangerous. More practically: in environments with multiple admins, the self-signed certificate means you cannot distinguish a legitimate Proxmox node from

QNAP NAS devices run QTS (or QuTS hero), which manages the web administration interface, file services, and applications like Qsync, myQNAPcloud, and others. Like Synology, QNAP ships with a self-signed certificate. This article covers replacing it with a Let’s Encrypt certificate through the built-in ACME client, uploading a custom certificate from an internal CA, and

RabbitMQ runs two network interfaces that benefit from TLS: the AMQP port (5672) that carries messages between producers, consumers, and the broker, and the management plugin’s HTTP API and web UI (port 15672). This article covers enabling TLS on both, configuring clients, setting up mutual TLS for producer/consumer authentication, and renewing certificates without message loss.

Redis added native TLS support in version 6.0, released in April 2020. Before that, TLS for Redis required a TLS proxy (stunnel, spiped, or nginx stream proxy). If you are still running Redis without TLS because “it is on a private network”, consider that Redis commands carry your application data — including session tokens, cache