Topics related to security, PKI, compliance requirements, industry standards, and risk management.
I remember the first time I configured TLS 1.3 support — I added TLSv1.3 to my Nginx config, reloaded, and thought “that’s it?”. On the surface it’s almost invisible. But what changed under the hood is significant, and understanding the differences has shaped how I think about TLS configuration. Some Context First TLS 1.2 came […]
TLS 1.3 vs TLS 1.2: What Actually Changed and Why It Matters Read Post »
Most of the time, TLS is one-way: the server proves its identity to the client by presenting a certificate, and the client just… connects. mTLS flips this around so the client also presents a certificate that the server validates. Both sides authenticate. I ran into mTLS for the first time when building an internal API
Mutual TLS (mTLS): Complete Guide to Client Certificate Authentication Read Post »
I discovered CAA records the hard way — reading about a case where a CA mistakenly issued a certificate for a domain they weren’t supposed to. After that, I started adding CAA records to every domain I manage. It takes five minutes and it’s one of those quiet security improvements that nobody notices until something
Self-signed certificates get a bad reputation because browsers show scary warning pages when they encounter them. But that reputation comes from misuse — using self-signed certs where a trusted certificate is needed. In the right context, a self-signed certificate is the correct tool. Here’s where I actually use them: internal APIs that communicate server-to-server, development
Self-Signed SSL Certificates: When to Use Them and How to Create Them Read Post »