PhilippTheServer

tls

Certificates, chains of trust, and issuing them without a public endpoint.

  1. DNS Wildcards and Empty Non-Terminals: The Answer That Is Not an Error

    A stale _acme-challenge TXT record makes a DNS wildcard return NODATA or NXDOMAIN: RFC 4592 closest encloser, empty non-terminals and a zone check.

    dns tls testing

  2. cert-manager for Mesh-Only Names That No ACME Challenge Can Reach

    Waiting for HTTP-01 challenge propagation, no such host: ACME cannot issue for private names. A cert-manager CA ClusterIssuer and trust distribution.

    kubernetes tls

  3. Trusting an Internal and a Public Certificate Authority in One Process

    curl: (60) SSL certificate problem after SSL_CERT_FILE points at an internal CA: it replaces the trust store. Append with update-ca-certificates instead.

    tls security

  4. Replacing Distributed SSH Keys with a Vault Certificate Authority

    TrustedUserCAKeys with the Vault ssh secrets engine: short-lived SSH user certificates limited by allowed_users and ttl instead of authorized_keys.

    vault security tls

All topics · All writing