Topics related to security, PKI, compliance requirements, industry standards, and risk management.
Cipher suite discussions tend to become abstract fast. You start with a simple question like “what should I put in my Nginx config?” and twenty minutes later you are reading about key exchange, bulk ciphers, MAC construction, AEAD, and browser compatibility from a table last updated three years ago. What helped me was treating cipher […]
TLS Cipher Suites: Hardening and Configuration That Actually Holds Up Read Post »
Rate limiting is one of those things that’s easy to get wrong in both directions — too loose and it does nothing, too tight and you start blocking real users. I’ve tuned rate limiting configs on production sites a few times and I’ve made both mistakes. Here’s what I’ve learned about how Nginx rate limiting
Nginx Rate Limiting: How to Stop Abuse Without Breaking Legitimate Traffic Read Post »
Sometimes you need to protect a URL quickly — a staging environment, an admin panel, a Prometheus metrics endpoint, internal documentation. Setting up a full authentication system is overkill. Nginx’s built-in basic authentication handles these cases well. Basic auth has a reputation for being insecure, but that reputation is mostly from HTTP days. Over HTTPS,
Nginx Basic Auth: Quick Access Control Without a Full Auth System Read Post »
SSH is more than a remote shell. The tunneling capabilities — local forwarding, remote forwarding, and dynamic SOCKS proxying — are genuinely useful for accessing services that aren’t directly reachable, and I reach for them regularly. Local Port Forwarding Local forwarding creates a tunnel: you connect to a local port, and SSH forwards the connection
SSH Port Forwarding and Tunneling: Practical Use Cases Read Post »
Security headers are easy to overlook. They’re not flashy — users never see them — but they add meaningful protection against a range of attacks: clickjacking, XSS, MIME sniffing, cross-origin data leaks. Adding them takes maybe 15 minutes, and scanners like securityheaders.com will grade your site. Here’s what I actually set and why each one
HTTP Security Headers: What to Set in Nginx and Why Read Post »
Fail2ban is one of those tools I install on every server within the first 30 minutes. It’s not a silver bullet — a determined attacker with a botnet of millions of IPs won’t be slowed down much — but it handles opportunistic attacks effectively and keeps your auth logs from filling up with garbage. The
Fail2ban Setup: Protecting SSH and Web Services from Brute Force Read Post »
I remember the first time I configured TLS 1.3 support — I added TLSv1.3 to my Nginx config, reloaded, and thought “that’s it?”. On the surface it’s almost invisible. But what changed under the hood is significant, and understanding the differences has shaped how I think about TLS configuration. Some Context First TLS 1.2 came
TLS 1.3 vs TLS 1.2: What Actually Changed and Why It Matters Read Post »
Most of the time, TLS is one-way: the server proves its identity to the client by presenting a certificate, and the client just… connects. mTLS flips this around so the client also presents a certificate that the server validates. Both sides authenticate. I ran into mTLS for the first time when building an internal API
Mutual TLS (mTLS): Complete Guide to Client Certificate Authentication Read Post »
I discovered CAA records the hard way — reading about a case where a CA mistakenly issued a certificate for a domain they weren’t supposed to. After that, I started adding CAA records to every domain I manage. It takes five minutes and it’s one of those quiet security improvements that nobody notices until something
Self-signed certificates get a bad reputation because browsers show scary warning pages when they encounter them. But that reputation comes from misuse — using self-signed certs where a trusted certificate is needed. In the right context, a self-signed certificate is the correct tool. Here’s where I actually use them: internal APIs that communicate server-to-server, development
Self-Signed SSL Certificates: When to Use Them and How to Create Them Read Post »