Author name: CrtMgr Team

Certificate revocation sounds simple on paper. A certificate should stop being trusted before its expiration date, so the issuer marks it as revoked and clients reject it. In practice, it is messier than most administrators expect. I ran into this the first time I had to replace a certificate after a private key leak. My […]

Certificate pinning has always sounded more appealing than it behaves in production. The idea is attractive: instead of trusting any certificate that chains to a public CA in the system trust store, your client trusts one specific certificate or public key. That narrows the trust model and can reduce exposure to misissued certificates or a

Running your own DNS server is not always the right answer. I do not set up BIND just because I can. Managed DNS is easier for many public zones, and for small environments it is usually the better trade-off. But there are cases where I still reach for BIND: internal split-horizon DNS, authoritative zones that

Both wildcard and SAN (Subject Alternative Name) certificates solve the same core problem — securing multiple domains or subdomains with one certificate. But they work differently and have different costs, limitations, and use cases. Picking the wrong type leads to either unnecessary expense or coverage gaps. What Wildcard Certificates Cover A wildcard certificate secures *.example.com

Apache VirtualHosts are one of those features that feel simple until you inherit a server with twelve site files, three half-finished redirects, one missing ServerName, and an SSL vhost that is somehow answering for the wrong domain. I have spent enough time on those systems that I no longer trust “it should match the right

.htaccess is one of those Apache features that refuses to die because it solves a real problem, especially on shared hosting and delegated environments. At the same time, it is responsible for a lot of messy rewrite rules, unnecessary per-request filesystem checks, and 500 errors caused by one bad line buried in a content directory.

A good Dockerfile is not just about making the build pass. It decides how large the image becomes, how much of the build cache you keep, how fast CI runs, how hard security reviews are, and whether a future admin can understand what you shipped. I have inherited enough ugly images to care about this

“DNS propagation” is one of those phrases that sounds precise until you spend enough time troubleshooting it. Then you realize most people use it as shorthand for several different problems: recursive caches hanging onto old answers, wrong nameserver delegation, negative caching after a missing record, local operating system cache, browser cache, CDN edge behavior, or