CrtMgr Tech Blog - Guides, Tips & Best Practices

TLS in Docker: Securing Containers Without Losing Your Mind

2026-07-07

When I first started running services in Docker, TLS felt like an afterthought. Everything was on localhost or an internal network, so I figured it didn’t matter much. Then I started exposing services, connecting containers to external databases, and dealing with client certificate authentication — and suddenly TLS was everywhere. Here’s what I’ve actually learned […]

TLS in Docker: Securing Containers Without Losing Your Mind Read Post »

TLS 1.3 vs TLS 1.2: What Actually Changed and Why It Matters

2026-07-06

I remember the first time I configured TLS 1.3 support — I added TLSv1.3 to my Nginx config, reloaded, and thought “that’s it?”. On the surface it’s almost invisible. But what changed under the hood is significant, and understanding the differences has shaped how I think about TLS configuration. Some Context First TLS 1.2 came

TLS 1.3 vs TLS 1.2: What Actually Changed and Why It Matters Read Post »

SSH Key Authentication on Linux: Setup, Security, and Things That Go Wrong

2026-07-05

I’ve set up SSH key authentication on probably hundreds of servers at this point. It’s one of those tasks that should be simple and usually is — until it isn’t. This is a practical walkthrough of how I do it, with the security considerations that actually matter and the troubleshooting steps that have saved me

SSH Key Authentication on Linux: Setup, Security, and Things That Go Wrong Read Post »

PKCS#12 / PFX Files: Complete Guide to Creating, Extracting, and Troubleshooting

2026-07-04

I’ve dealt with PKCS#12 files (also called PFX or P12 — the terms are interchangeable) more times than I’d like. Mostly when migrating certificates to Windows, working with Java keystores, or handing certificates off to developers who aren’t familiar with PEM files. The format is useful but the tooling around it is inconsistent and the

PKCS#12 / PFX Files: Complete Guide to Creating, Extracting, and Troubleshooting Read Post »

OCSP Stapling in Nginx: What It Is, Why It Matters, and How to Configure It

2026-07-03

I spent a while ignoring OCSP stapling because it felt like an advanced optimization that wasn’t worth the effort. Then I actually measured the TLS handshake times on a server without it and realized visitors were waiting for an extra round-trip to a CA’s OCSP server on every new connection. That changes the calculus. What

OCSP Stapling in Nginx: What It Is, Why It Matters, and How to Configure It Read Post »

OpenSSL Commands I Actually Use — A Practical Cheatsheet

2026-06-29

I’ve been using OpenSSL for years and I still look things up. Not because the tool is bad — it’s incredibly powerful — but because the syntax is inconsistent and there are so many subcommands that it’s hard to keep everything in your head at once. This is my personal list of commands I reach

OpenSSL Commands I Actually Use — A Practical Cheatsheet Read Post »

How I Set Up Nginx as a Reverse Proxy with SSL Termination

2026-06-29

I’ve configured Nginx as a reverse proxy dozens of times, and while the basic setup is always similar, the details — SSL termination, certificate management, header forwarding, timeout settings — are where things get interesting. This is how I approach it, with the reasoning behind each decision. What “SSL Termination at the Proxy” Means The

How I Set Up Nginx as a Reverse Proxy with SSL Termination Read Post »

Mutual TLS (mTLS): Complete Guide to Client Certificate Authentication

2026-06-28

Most of the time, TLS is one-way: the server proves its identity to the client by presenting a certificate, and the client just… connects. mTLS flips this around so the client also presents a certificate that the server validates. Both sides authenticate. I ran into mTLS for the first time when building an internal API

Mutual TLS (mTLS): Complete Guide to Client Certificate Authentication Read Post »

How to Generate a CSR (Certificate Signing Request) the Right Way

2026-06-25

I’ve gone through the CSR generation process dozens of times across different servers, operating systems, and environments. And every time I thought it was straightforward, I ran into some edge case that tripped me up — a wrong key size, a missing SAN field, a passphrase that caused issues with the web server. So here’s

How to Generate a CSR (Certificate Signing Request) the Right Way Read Post »

DNS CAA Records: The Underused Security Feature That Controls Who Can Issue Certificates for Your Domain

2026-06-22

I discovered CAA records the hard way — reading about a case where a CA mistakenly issued a certificate for a domain they weren’t supposed to. After that, I started adding CAA records to every domain I manage. It takes five minutes and it’s one of those quiet security improvements that nobody notices until something

DNS CAA Records: The Underused Security Feature That Controls Who Can Issue Certificates for Your Domain Read Post »