Guides, best practices, and technical explanations related to SSL/TLS certificates, HTTPS, encryption, and secure communications.
When I first started running services in Docker, TLS felt like an afterthought. Everything was on localhost or an internal network, so I figured it didn’t matter much. Then I started exposing services, connecting containers to external databases, and dealing with client certificate authentication — and suddenly TLS was everywhere. Here’s what I’ve actually learned
TLS in Docker: Securing Containers Without Losing Your Mind Read Post »
I remember the first time I configured TLS 1.3 support — I added TLSv1.3 to my Nginx config, reloaded, and thought “that’s it?”. On the surface it’s almost invisible. But what changed under the hood is significant, and understanding the differences has shaped how I think about TLS configuration. Some Context First TLS 1.2 came
TLS 1.3 vs TLS 1.2: What Actually Changed and Why It Matters Read Post »
I’ve dealt with PKCS#12 files (also called PFX or P12 — the terms are interchangeable) more times than I’d like. Mostly when migrating certificates to Windows, working with Java keystores, or handing certificates off to developers who aren’t familiar with PEM files. The format is useful but the tooling around it is inconsistent and the
PKCS#12 / PFX Files: Complete Guide to Creating, Extracting, and Troubleshooting Read Post »
Most of the time, TLS is one-way: the server proves its identity to the client by presenting a certificate, and the client just… connects. mTLS flips this around so the client also presents a certificate that the server validates. Both sides authenticate. I ran into mTLS for the first time when building an internal API
Mutual TLS (mTLS): Complete Guide to Client Certificate Authentication Read Post »
I’ve gone through the CSR generation process dozens of times across different servers, operating systems, and environments. And every time I thought it was straightforward, I ran into some edge case that tripped me up — a wrong key size, a missing SAN field, a passphrase that caused issues with the web server. So here’s
How to Generate a CSR (Certificate Signing Request) the Right Way Read Post »
Converting SSL certificates is one of those tasks that looks straightforward until you’re knee-deep in error messages at 11 PM before a deployment. I’ve converted hundreds of certificates across different server setups, and the same situations come up repeatedly: CA sends PEM, server needs PFX. Client needs Java keystore, you only have CRT and KEY
How to Convert SSL Certificates Between Formats Using OpenSSL Read Post »
Debugging TLS issues is something I do more than I’d like. Browser errors are often vague, and getting to the actual root cause usually requires some manual inspection with OpenSSL. These are the techniques I actually use. Connecting to a Server and Inspecting the Certificate The most basic thing — see what certificate a server
OpenSSL: Verifying Certificate Chains and Debugging TLS Connections Read Post »
A lot of Windows certificate guides stop at IIS bindings. That is useful, but it is only part of the picture. On real Windows Server systems I often need to inspect certificates outside IIS, import them for RDP, trust an internal root CA, verify that a private key actually landed where the service account can
Windows Server Certificate Management with MMC Guide Read Post »
Every time you load an HTTPS page, a TLS handshake happens in milliseconds. Most people treat it as a black box — it works or it doesn’t. But understanding what actually happens is useful when you’re debugging TLS errors, optimizing performance, or configuring cipher suites. The Purpose of the Handshake The handshake does three things:
Understanding TLS Handshake: What Happens When You Connect to HTTPS Read Post »
SNI is one of those TLS features that quietly made modern HTTPS hosting practical. Most people never think about it until something breaks, and then it becomes the entire problem. I usually notice SNI only during troubleshooting: the wrong certificate shows up, a test succeeds against the IP but fails against the hostname, an old
SNI (Server Name Indication): How It Works and Why It Still Matters Read Post »