Active Directory Federation Services (ADFS) is a security-sensitive component — it handles authentication tokens for applications like Office 365, SharePoint, and third-party SaaS. It uses multiple certificates: the SSL/TLS certificate for the service endpoint, the token-signing certificate, and the token-decryption certificate. This article focuses on replacing the SSL certificate used by the ADFS service endpoint,

Caddy is the only major web server that enables HTTPS by default. When you give it a domain name, it automatically obtains and renews a Let’s Encrypt certificate without any additional configuration. This makes it operationally simple, but there are important configuration options for production deployments: wildcard certificates, custom CA integration, internal hostnames, and multi-server

PostgreSQL has supported TLS since version 7.4, yet most self-managed PostgreSQL instances I encounter in the wild are running without it. The default pg_hba.conf allows password authentication without requiring encryption, meaning credentials and query results travel in the clear across the network. This article covers enabling server-side TLS, verifying the configuration, enforcing encryption through pg_hba.conf,

Envoy is a high-performance proxy used as a sidecar in service meshes (Istio, Consul Connect) and as a standalone edge proxy. TLS in Envoy is more explicitly configured than in nginx or HAProxy — every certificate, CA bundle, and TLS parameter is referenced through a structured YAML API. This article covers configuring Envoy as a

Exchange Server uses TLS certificates for multiple services: OWA, ActiveSync, Autodiscover, SMTP (internal and external), IMAP, and POP3. Replacing an expiring certificate in Exchange involves importing the new certificate, assigning it to the correct services, and removing the old one — without interrupting mail flow during the process. This article walks through every step, including

Grafana ships with HTTP enabled by default. That is fine for a local lab, but the moment Grafana is reachable over any network you do not fully control, you need TLS. I learned that lesson when a penetration test caught session tokens traveling in the clear between an on-call engineer’s laptop and a Grafana instance

HAProxy is one of the most widely deployed load balancers and TLS terminators in production environments. It can terminate TLS (decrypt and proxy plain HTTP to backends), bridge TLS (re-encrypt to backends), or pass TLS through unchanged to backend servers. This article covers configuring SSL termination with modern cipher settings, managing multiple certificates for different

Apache Kafka’s default configuration runs without any encryption. Every message, every authentication credential, every consumer group offset travels in plaintext between producers, consumers, and brokers. When Kafka is deployed in a multi-tenant environment or carries data that crosses network boundaries, TLS is not optional. This article explains how to generate certificates, configure Kafka brokers for

Loki’s default configuration sends log data — including application errors, authentication events, and stack traces — over unencrypted HTTP. If Promtail, Grafana, or any other client is sending logs across a network boundary without TLS, those logs are readable in transit. This article shows how to enable HTTPS on Loki’s HTTP and gRPC endpoints, configure

Mattermost is a self-hosted team chat application that handles sensitive internal communications — incident response discussions, credentials shared in channels, private messages between team members. Running it without TLS means all of that travels in plaintext. This article covers enabling HTTPS on Mattermost using its built-in TLS support, or placing it behind nginx, setting the