Debian 11 in August raised the default OpenSSL security level, and connections that had worked for years started failing with an unhelpful handshake error. The default moved from…
A calendar reminder is a person, and a person on holiday is an outage; days-to-expiry as a metric is an alert like any other. earliest_cert_expiry across the chain…
OCSP stapling saves the client a round trip to the certificate authority, and the configuration is completely inert without one extra line that nothing warns about. nginx needs…
Monitoring that reports an expired certificate is monitoring that reports an outage, and reading the file on disk misses the most common failure entirely. Checking over the network…
Stapling saves the client a round trip to the certificate authority and stops the CA learning which sites that user visits, and the configuration is inert without one…
A timer that has been scheduled and has never actually renewed anything is untested code with a deadline, and the first sign of trouble is a browser warning.…