Every time you load an HTTPS page, a TLS handshake happens in milliseconds. Most people treat it as a black box — it works or it doesn’t. But understanding what actually happens is useful when you’re debugging TLS errors, optimizing performance, or configuring cipher suites. The Purpose of the Handshake The handshake does three things:
Understanding TLS Handshake: What Happens When You Connect to HTTPS Read Post »
I used cron for years without really questioning it. It works, it’s everywhere, it’s well-understood. But over time I noticed a few recurring frustrations: no built-in logging, missed jobs when the system was off, no dependency management, and debugging failed jobs meant hunting through syslog. Systemd timers solve most of these problems, and on systems
Systemd Timers: A Better Cron for Modern Linux Systems Read Post »
I like monitoring systems that make their assumptions obvious. Prometheus is one of them. It scrapes targets on a schedule, stores time series locally, evaluates rules, and fires alerts when conditions match. There is no mystery about where the numbers came from. If a graph looks wrong, I can usually inspect the raw metric in
Prometheus and Node Exporter for Linux Monitoring Read Post »
IIS has the most friction of any common web server when it comes to SSL certificate management. Not because it’s technically harder, but because the workflow is different from Linux-based servers and the GUI-heavy approach obscures what’s actually happening. I’ve set up SSL on IIS for clients a number of times, and each time I
Installing SSL Certificates on Windows Server IIS: Step-by-Step Guide Read Post »
Disk space has a way of filling up at the worst possible time. I’ve had databases refuse to write because /var was full, deployments fail because /tmp was full, and applications crash because their log directories hit quota. All of them were preventable with basic disk space management. Here’s how I handle it. Finding Large
Server Disk Space Management: Finding What’s Eating Your Storage Read Post »
SNI is one of those TLS features that quietly made modern HTTPS hosting practical. Most people never think about it until something breaks, and then it becomes the entire problem. I usually notice SNI only during troubleshooting: the wrong certificate shows up, a test succeeds against the IP but fails against the hostname, an old
SNI (Server Name Indication): How It Works and Why It Still Matters Read Post »
People love declaring iptables dead every few years. The kernel moved on, nftables is the direction of travel, and higher-level tools like UFW and firewalld are what many admins touch day to day. All of that is true. It is also true that I still run into iptables constantly: older hosts, minimal cloud images, vendor
iptables Firewall Practical Guide for Linux Read Post »
Self-signed certificates get a bad reputation because browsers show scary warning pages when they encounter them. But that reputation comes from misuse — using self-signed certs where a trusted certificate is needed. In the right context, a self-signed certificate is the correct tool. Here’s where I actually use them: internal APIs that communicate server-to-server, development
Self-Signed SSL Certificates: When to Use Them and How to Create Them Read Post »
I spent years using OpenVPN for internal VPNs and I was always mildly frustrated by it. The configuration files are long, the certificates require careful management, the performance is decent but not great, and debugging connection issues is painful. Then I tried WireGuard and everything got simpler. WireGuard is modern, fast, and has a remarkably
WireGuard VPN on Linux: Setup and Configuration Read Post »
SSH is one of the first services I lock down on a new server because it is usually the front door to everything else. If SSH is weak, the rest of your hardening work starts from a bad premise. If SSH is solid, you at least force attackers into harder, noisier, or less direct paths.
SSH Hardening: A Practical Guide for Production Servers Read Post »