Remote Desktop Gateway (RD Gateway) uses TLS for two purposes: the HTTPS tunnel that wraps RDP traffic, and the authentication handshake for RD Gateway policies. When the certificate expires, remote employees and administrators who connect through RD Gateway lose access immediately. This article covers replacing the RD Gateway certificate using the RD Gateway Manager, PowerShell, […]

Rocket.Chat is a self-hosted Slack alternative that handles real-time messages, file uploads, and video calls. Without TLS, all of that is visible on the network. Rocket.Chat is a Node.js application that does not handle TLS natively in most deployment configurations — TLS is the responsibility of a reverse proxy in front of it. This article

Prometheus is almost always deployed without TLS because the documentation used to treat it as an internal-only tool. By the time someone asks “is this metrics data sensitive?”, the server has been running for a year on port 9090 without encryption. This article covers enabling HTTPS on Prometheus itself — the scrape endpoint and the

SonarQube runs an Elasticsearch node internally and serves its web interface on port 9000. It does not handle TLS natively — it is designed to be deployed behind a reverse proxy. This article covers setting up nginx as a TLS reverse proxy in front of SonarQube, configuring the sonar.web.publicRootUrl property so that generated links are

SQL Server encrypts every connection when a certificate is configured — but if no certificate is installed, SQL Server generates a self-signed one at startup that is only trusted by the local machine. Remote clients get the “self-signed certificate” warning (or more dangerously, they silently accept it). This article covers installing a proper TLS certificate,

Synology DiskStation Manager (DSM) comes with a self-signed certificate that covers the web administration interface. DSM also hosts multiple services — File Station, WebDAV, Surveillance Station, Drive, and others — all of which can use the same certificate. This article covers replacing the DSM certificate with a Let’s Encrypt or custom certificate, assigning it to

Traefik is a reverse proxy designed for container environments. One of its most useful features is automatic TLS certificate management — Traefik can request, store, and renew Let’s Encrypt certificates without any manual certificate management. This article explains how to configure Traefik v3 for automatic HTTPS with Let’s Encrypt using both HTTP-01 and DNS-01 challenges,

TrueNAS ships with a self-signed certificate and shows a browser warning every time you open the web UI. The warning is dismissible, but it also means you cannot verify you are connected to the real TrueNAS system and not an impostor — important for NAS devices that may hold backup data or sensitive files. This

Wiki.js is a Node.js wiki application that supports TLS in two ways: its own built-in HTTPS server, or via a reverse proxy. This article covers both approaches, explains how to configure the correct site URL so that generated links and authentication callbacks work, and shows how to set up OAuth providers with HTTPS redirect URIs.

Windows Admin Center (WAC) installs with a self-signed certificate that generates browser warnings every time you open it. When WAC is deployed in Gateway mode on a Windows Server (accessible to multiple admins over the network), this warning is more than cosmetic — it means you cannot verify you are connecting to the legitimate WAC