Türker Yıldırım

tls

  • The certificate scan, two quarters on

    Note2 min read

    A quarterly scan of our own address space, after the first run found two things nobody owned. The first run of a scan like this finds the accumulated…

  • The second host, and the failover we finally built

    Deep dive14 min read

    Seven years on one host, and a business requirement that finally arrived. A recovery time that assumes the host comes back.

  • nginx as the only thing holding a certificate

    Note2 min read

    A certificate loaded by one process, and a reload that had to work for the renewal to take effect. Three steps, of which the first two report success…

  • A certificate inventory built by scanning ourselves

    Note1 min read

    An inventory of what is configured, compared against an inventory of what is actually listening. Scanning your own address space is a thing that feels excessive until it…

  • An internal certificate from a private authority, expiring

    Note2 min read

    A service-to-service certificate issued by an internal authority in 2022, with a three-year validity nobody had recorded. A certificate with a three-year validity is a reminder set three…

  • The backup that had to leave the building

    Deep dive9 min read

    Every backup in one provider’s object storage, and a disaster recovery plan that assumes the disaster is local.

  • The incident that was a certificate, again

    Deep dive10 min read

    The third certificate incident in six years, each with a different cause. An expired certificate on a service nobody remembered was serving TLS.

  • Alerting on the served certificate rather than the renewal

    Note1 min read

    Monitoring the renewal job answers whether it ran; monitoring the certificate answers whether it worked. The check runs from outside and depends on none of the machinery that…

  • nginx 1.28, and enabling HTTP/3 on purpose

    Note2 min read

    HTTP/3 support has been present and experimental for a while, and the April stable release made enabling it a decision rather than a gamble. The Alt-Svc header is…

  • The VPS that had been running since 2019

    Deep dive14 min read

    A host provisioned in 2019, upgraded in place three times, and a provisioning script that has never been run against an empty machine.