Automation, scripting, infrastructure management for DevOps, SysAdmin and other Tech stuff
I’ve set up SSH key authentication on probably hundreds of servers at this point. It’s one of those tasks that should be simple and usually is — until it isn’t. This is a practical walkthrough of how I do it, with the security considerations that actually matter and the troubleshooting steps that have saved me […]
SSH Key Authentication on Linux: Setup, Security, and Things That Go Wrong Read Post »
I spent a while ignoring OCSP stapling because it felt like an advanced optimization that wasn’t worth the effort. Then I actually measured the TLS handshake times on a server without it and realized visitors were waiting for an extra round-trip to a CA’s OCSP server on every new connection. That changes the calculus. What
OCSP Stapling in Nginx: What It Is, Why It Matters, and How to Configure It Read Post »
I’ve been using OpenSSL for years and I still look things up. Not because the tool is bad — it’s incredibly powerful — but because the syntax is inconsistent and there are so many subcommands that it’s hard to keep everything in your head at once. This is my personal list of commands I reach
OpenSSL Commands I Actually Use — A Practical Cheatsheet Read Post »
I’ve configured Nginx as a reverse proxy dozens of times, and while the basic setup is always similar, the details — SSL termination, certificate management, header forwarding, timeout settings — are where things get interesting. This is how I approach it, with the reasoning behind each decision. What “SSL Termination at the Proxy” Means The
How I Set Up Nginx as a Reverse Proxy with SSL Termination Read Post »
I lost access to a private key once. Not because someone stole it — I upgraded a server, thought I’d moved everything, and realized a week later that the key for one of the domains was gone. The certificate was still valid, the site was working with the cached config, but when it came time
Automating SSL Certificate Backups: A Practical Approach Read Post »
Apache’s approach to SSL is fundamentally different from Nginx. Where Nginx has SSL baked in, Apache uses a module system — mod_ssl — that needs to be explicitly enabled. The configuration syntax is also more verbose. That’s not necessarily bad; Apache’s granular configuration options can be very useful. But it means more places where things
Installing and Configuring SSL in Apache: Virtual Hosts, Modules, and Best Practices Read Post »
IIS has the most friction of any common web server when it comes to SSL certificate management. Not because it’s technically harder, but because the workflow is different from Linux-based servers and the GUI-heavy approach obscures what’s actually happening. I’ve set up SSL on IIS for clients a number of times, and each time I
Installing SSL Certificates on Windows Server IIS: Step-by-Step Guide Read Post »
Let’s Encrypt changed how people think about SSL. Before it existed, getting a certificate meant paying $50–$200/year and going through manual validation. Now I can have a valid, trusted certificate on a new server in under two minutes. The certificates are free, the process is automated, and renewal happens without any manual intervention once you
Let’s Encrypt with Certbot – Automated Renewal Read Post »