Guides, best practices, and technical explanations related to SSL/TLS certificates, HTTPS, encryption, and secure communications.
Windows Admin Center (WAC) installs with a self-signed certificate that generates browser warnings every time you open it. When WAC is deployed in Gateway mode on a Windows Server (accessible to multiple admins over the network), this warning is more than cosmetic — it means you cannot verify you are connecting to the legitimate WAC
Windows Admin Center TLS Certificate: Replacing the Self-Signed Certificate Read Post »
If you spend enough time around certificates, you eventually run into a hostname mismatch that looks absurdly avoidable. The certificate is valid, signed by a trusted CA, not expired, and still the browser rejects it because the hostname is not covered the way someone assumed. Most of those incidents come back to SANs. Subject Alternative
SSL Subject Alternative Names (SANs): Everything You Need to Know Read Post »
I generate keys often enough that I no longer trust my memory for the exact OpenSSL syntax. The commands are close, but not close enough, and the difference between a good key file and a bad production day is usually one flag, one wrong format, or one decision made too quickly. This guide is the
OpenSSL RSA and EC Key Generation Guide Read Post »
Most Windows certificate guides are either too shallow to help in production or so obsessed with PKI theory that they ignore what I actually do at 2 a.m. when a binding is broken, a PFX will not import, or I need to find every certificate expiring in the next month. This is the practical side
PowerShell for SSL Certificate Management: Commands I Actually Use Read Post »
If I had to keep only one command-line tool for TLS troubleshooting, it would be openssl s_client. Not because it is pretty. It is not. The output is noisy, old-fashioned, and easy to misread when you are in a hurry. But it connects directly to the service, shows you the certificate chain, reveals the negotiated
OpenSSL s_client: The TLS Debugging Tool I Reach For Every Day Read Post »
Getting a wildcard certificate from Let’s Encrypt is a bit more involved than a regular single-domain cert. You can’t use an HTTP challenge for wildcards — Let’s Encrypt requires DNS validation, which means you need to create a TXT record to prove you own the domain. That adds complexity, but once it’s set up and
Let’s Encrypt Wildcard Certificates with DNS Challenge Read Post »
Managing TLS in Kubernetes is different enough from regular server TLS that it’s worth covering separately. The concepts are the same — certificates, private keys, certificate authorities — but the mechanics of how you provision, store, and rotate certificates involve Kubernetes-specific objects. I’ve worked through this on a few clusters. Here’s the practical picture. The
Kubernetes TLS: Securing Ingress with Certificates Read Post »
Certificate Transparency (CT) is one of those things you use every day without thinking about it. Every time your browser connects to an HTTPS site, Certificate Transparency is working in the background to help ensure the certificate you’re seeing is legitimate. Understanding it has practical implications if you manage SSL certificates. The Problem CT Solves
Certificate Transparency Logs: What They Are and Why You Should Care Read Post »
There’s a point in most sysadmin careers where you stop relying entirely on public CAs and start thinking about internal infrastructure. Internal APIs, staging environments, service-to-service TLS, developer machines — all of these benefit from having a proper internal CA rather than a pile of self-signed certificates scattered everywhere. I set up my first internal
Building Your Own Certificate Authority with OpenSSL Read Post »
I’ve been using Certbot for years and it works fine. But a while back I started running into situations where Certbot felt too heavy — too many dependencies, too much Python version drama, and the way it modifies your Nginx config automatically sometimes caused more problems than it solved. That’s when I started looking at
acme.sh: A Lightweight Alternative to Certbot for Let’s Encrypt Read Post »