Articles & Guides

Weak cipher suites (RC4, 3DES, MD5, EXPORT) drop SSL Labs grade to B or F. Learn how to detect them, disable in nginx, and pick a safe set.

HSTS and preload list — how to force browsers to always use HTTPS. Strict-Transport-Security setup, hstspreload.org submission, gotchas.

How to get a free Let's Encrypt SSL certificate: certbot setup for nginx and Apache, wildcard certificates via DNS-01, automatic renewal every 90 days, alternative ACME clients, and common issuance errors. Step-by-step commands for Ubuntu, Debian, and CentOS.

TLS 1.3 vs TLS 1.2 — detailed comparison: speed, security, compatibility. Step-by-step nginx migration guide with backward compatibility notes.

How an SSL certificate chain works: leaf, intermediate and root certs, trust stores and path building, plus verification commands and incomplete-chain fixes.

Wildcard vs SAN certificates — differences, pricing, security, automation. Which cert type to pick for different architectures and how many domains to cover.

Self-signed SSL certificates: when they're appropriate, how to create them with openssl, trust them system-wide, and when to use Let's Encrypt or internal PKI instead.

Mixed content blocks scripts, styles and iframes on HTTPS pages. Active vs passive, finding every http URL in code and database, CSP reports, regression control.

SSL handshake failed — deep dive into causes and diagnosis: protocols, SNI, cipher suites, client certs. openssl and curl examples for debugging.

Renewing is rarely where the time goes: the certificate is often already renewed and the server still serves the old one. Find which failure you actually have.