Windows Admin Center (WAC) installs with a self-signed certificate that generates browser warnings every time you open it. When WAC is deployed in Gateway mode on a Windows Server (accessible to multiple admins over the network), this warning is more than cosmetic — it means you cannot verify you are connecting to the legitimate WAC
Windows Admin Center TLS Certificate: Replacing the Self-Signed Certificate Read Post »
I still use tar constantly, even in environments with snapshotting, object storage, and dedicated backup platforms. It is not because tar is magical. It is because it is everywhere, predictable, scriptable, and surprisingly flexible once you stop treating it as just “that old archive command.” For small servers, config backups, pre-maintenance snapshots, application exports, and
tar and gzip Backup Strategies on Linux Read Post »
If you spend enough time around certificates, you eventually run into a hostname mismatch that looks absurdly avoidable. The certificate is valid, signed by a trusted CA, not expired, and still the browser rejects it because the hostname is not covered the way someone assumed. Most of those incidents come back to SANs. Subject Alternative
SSL Subject Alternative Names (SANs): Everything You Need to Know Read Post »
I like systemd more now than I did when I first had to live with it. My early frustration usually came from treating unit files like mysterious magic instead of what they really are: declarative service definitions with a few sharp edges. Once I started writing them carefully, validating paths, and reading logs instead of
Writing and Managing systemd Unit Files: A Practical Guide Read Post »
I generate keys often enough that I no longer trust my memory for the exact OpenSSL syntax. The commands are close, but not close enough, and the difference between a good key file and a bad production day is usually one flag, one wrong format, or one decision made too quickly. This guide is the
OpenSSL RSA and EC Key Generation Guide Read Post »
Most Windows certificate guides are either too shallow to help in production or so obsessed with PKI theory that they ignore what I actually do at 2 a.m. when a binding is broken, a PFX will not import, or I need to find every certificate expiring in the next month. This is the practical side
PowerShell for SSL Certificate Management: Commands I Actually Use Read Post »
If I had to keep only one command-line tool for TLS troubleshooting, it would be openssl s_client. Not because it is pretty. It is not. The output is noisy, old-fashioned, and easy to misread when you are in a hurry. But it connects directly to the service, shows you the certificate chain, reveals the negotiated
OpenSSL s_client: The TLS Debugging Tool I Reach For Every Day Read Post »
Nginx proxy_cache can make a struggling application look healthy again, but it can also serve the wrong page to the wrong user if you get sloppy. I have seen both outcomes. The good version is a backend that suddenly stops melting under traffic spikes. The bad version is an authenticated dashboard cached for everyone because
Nginx Proxy Cache Configuration: How I Set It Up Without Caching the Wrong Thing Read Post »
WebSocket proxying looks deceptively simple until you hit the first timeout, load balancer mismatch, or upgrade failure. I have seen people copy a normal reverse proxy block, change the upstream URL, and assume it is done. Then they wonder why the browser reports a failed handshake, why idle connections die at sixty seconds, or why
Nginx WebSocket Proxy Configuration: The Settings That Actually Matter Read Post »
Cipher suite discussions tend to become abstract fast. You start with a simple question like “what should I put in my Nginx config?” and twenty minutes later you are reading about key exchange, bulk ciphers, MAC construction, AEAD, and browser compatibility from a table last updated three years ago. What helped me was treating cipher
TLS Cipher Suites: Hardening and Configuration That Actually Holds Up Read Post »