Without stapling, a browser checking whether your certificate is revoked makes its own request to the CA — adding latency, and telling the CA which sites that user…
The header is one line. The work is finding out what it will break — which means report-only for weeks, and reading violations that are mostly not your…
1.3 was finalised in August, and its cipher suites are configured separately from 1.2’s — so a hardened ssl_ciphers line copied from a 2016 guide silently governs only…
Monitoring that tells you a certificate has expired is monitoring that tells you about an outage. The useful alert fires while there is still time to fix the…
A wildcard certificate can only be issued through the DNS challenge, which means whatever renews it can write records in your zone — and the default API token…