Author name: CrtMgr Team

Fail2ban is one of those tools I install on every server within the first 30 minutes. It’s not a silver bullet — a determined attacker with a botnet of millions of IPs won’t be slowed down much — but it handles opportunistic attacks effectively and keeps your auth logs from filling up with garbage. The […]

Networking is the thing that trips up most people learning Docker. Container A can’t reach container B, or a container can’t reach the internet, or you expose a port but nothing connects. Most of these problems come down to not understanding how Docker’s networking modes actually work. I spent a fair amount of time confused

DNS is something most sysadmins interact with constantly without necessarily understanding the full picture. Setting up an A record and MX record is easy enough, but when things break or you need to configure something more complex, knowing what each record type does and how it works becomes important. Here’s the DNS record types I

Certificate Transparency (CT) is one of those things you use every day without thinking about it. Every time your browser connects to an HTTPS site, Certificate Transparency is working in the background to help ensure the certificate you’re seeing is legitimate. Understanding it has practical implications if you manage SSL certificates. The Problem CT Solves

There’s a point in most sysadmin careers where you stop relying entirely on public CAs and start thinking about internal infrastructure. Internal APIs, staging environments, service-to-service TLS, developer machines — all of these benefit from having a proper internal CA rather than a pile of self-signed certificates scattered everywhere. I set up my first internal

Apache’s SSL configuration has improved a lot over the years. Getting it right involves enabling the right modules, configuring ciphers, setting up HSTS, and making sure the certificate chain is complete. Here’s the configuration I use. Required Modules Make sure these modules are enabled: Verify: Virtual Host Configuration A complete HTTPS virtual host: SSLProtocol -all

mod_rewrite is one of Apache’s most powerful and most confusing modules. The syntax is dense, the flags are cryptic, and debugging is painful. But it’s also everywhere — almost every HTTPS redirect, URL rewrite, and routing rule in Apache uses it. I’ve spent a lot of time staring at mod_rewrite configs. Here’s what I actually

I resisted Ansible for a while. My servers were small in number and I could remember what was on each one. Then I had to rebuild a server from scratch after a hardware failure, and I realized I had no idea exactly what I’d done to set it up. It took most of a day

I’ve been using Certbot for years and it works fine. But a while back I started running into situations where Certbot felt too heavy — too many dependencies, too much Python version drama, and the way it modifies your Nginx config automatically sometimes caused more problems than it solved. That’s when I started looking at

When I first started running services in Docker, TLS felt like an afterthought. Everything was on localhost or an internal network, so I figured it didn’t matter much. Then I started exposing services, connecting containers to external databases, and dealing with client certificate authentication — and suddenly TLS was everywhere. Here’s what I’ve actually learned