Automation, scripting, infrastructure management for DevOps, SysAdmin and other Tech stuff
I spent a while ignoring OCSP stapling because it felt like an advanced optimization that wasn’t worth the effort. Then I actually measured the TLS handshake times on a server without it and realized visitors were waiting for an extra round-trip to a CA’s OCSP server on every new connection. That changes the calculus. What […]
OCSP Stapling in Nginx: What It Is, Why It Matters, and How to Configure It Read Post »
I’ve been using OpenSSL for years and I still look things up. Not because the tool is bad — it’s incredibly powerful — but because the syntax is inconsistent and there are so many subcommands that it’s hard to keep everything in your head at once. This is my personal list of commands I reach
OpenSSL Commands I Actually Use — A Practical Cheatsheet Read Post »
I’ve configured Nginx as a reverse proxy dozens of times, and while the basic setup is always similar, the details — SSL termination, certificate management, header forwarding, timeout settings — are where things get interesting. This is how I approach it, with the reasoning behind each decision. What “SSL Termination at the Proxy” Means The
How I Set Up Nginx as a Reverse Proxy with SSL Termination Read Post »
I lost access to a private key once. Not because someone stole it — I upgraded a server, thought I’d moved everything, and realized a week later that the key for one of the domains was gone. The certificate was still valid, the site was working with the cached config, but when it came time
Automating SSL Certificate Backups: A Practical Approach Read Post »
Databases are special. Regular file backups don’t work well for PostgreSQL — backing up the data directory while the server is running is likely to give you a corrupt snapshot. You need PostgreSQL-aware tools. Here’s what I actually use for backing up PostgreSQL databases, from simple single-database dumps to continuous archiving. pg_dump — The Standard
PostgreSQL Backup and Restore on Linux Read Post »
When someone asks for “just FTP access” to a Linux server, I almost always translate that into “they need file transfer, but we should not open an actual FTP-shaped problem.” In most modern environments, SFTP is the right answer. It uses SSH, it is encrypted by default, it does not need a separate daemon in
SFTP Server Setup with Chroot on Linux Read Post »
Debugging TLS issues is something I do more than I’d like. Browser errors are often vague, and getting to the actual root cause usually requires some manual inspection with OpenSSL. These are the techniques I actually use. Connecting to a Server and Inspecting the Certificate The most basic thing — see what certificate a server
OpenSSL: Verifying Certificate Chains and Debugging TLS Connections Read Post »
I do not like certificate expiry surprises, and I do not trust calendar reminders as the only defense. Certificates expire on weekends, behind CDNs, on forgotten admin panels, on odd ports, and on third-party services nobody thought to inventory. That is why I prefer central monitoring over scattered shell scripts living on random servers. Zabbix
Zabbix SSL Certificate Monitoring Read Post »
Apache’s approach to SSL is fundamentally different from Nginx. Where Nginx has SSL baked in, Apache uses a module system — mod_ssl — that needs to be explicitly enabled. The configuration syntax is also more verbose. That’s not necessarily bad; Apache’s granular configuration options can be very useful. But it means more places where things
Installing and Configuring SSL in Apache: Virtual Hosts, Modules, and Best Practices Read Post »
A lot of Windows certificate guides stop at IIS bindings. That is useful, but it is only part of the picture. On real Windows Server systems I often need to inspect certificates outside IIS, import them for RDP, trust an internal root CA, verify that a private key actually landed where the service account can
Windows Server Certificate Management with MMC Guide Read Post »