DNS and SSL

Articles

• ACME clients and automated renewal

  Tutorial

  Compare Certbot and acme.sh ACME clients for TLS issuance, renewal automation and which fits your server.

• ALPN and HTTP/2 negotiation

  Reference guide

  How ALPN negotiates HTTP/2 inside the TLS handshake, why a mismatch silently falls back to HTTP/1.1, and where to check it.

• CAA records setup

  Reference guide

  CAA records guide: what the issue and issuewild tags do, how issuers check them, and a safe step-by-step setup.

• Certificate Transparency logs and how sites return an error without one

  Reference guide

  Learn how Certificate Transparency logs certify public TLS certificates and why Chrome blocks certificates without SCTs.

• How to check DNS propagation

  Tutorial

  How to check DNS propagation with public DNS checkers, nslookup and dig, and how to test A, CNAME, MX and NS records worldwide.

• CNAME vs A records

  Reference guide

  CNAME vs A records explained with lookup examples, apex rules, CNAME flattening, and a table to decide which record to create.

• Certificate revocation CRL vs OCSP vs CRLSets

  Reference guide

  Compare CRLs, OCSP and OCSP stapling, and CRLSets/CRLite for TLS certificate revocation, and learn what Chrome, Firefox and Safari now do in practice.

• What CNAME flattening is and how to use it

  Reference guide

  What CNAME flattening is, why apex CNAME records fail normally, and when to point your root domain at a hosting service.

• DNS delegation and glue records

  Reference guide

  Understand DNS delegation, how a parent zone points to child nameservers with NS records, and when glue records are required to resolve the nameservers themselves.

• DNS over HTTPS explained

  Reference guide

  DNS over HTTPS explained: how DoH encrypts lookups, the resolver change it makes for browsers, and what it means for DNS debugging.

• DNS over QUIC (DoQ) explained and when to use it

  Reference guide

  DNS over QUIC (RFC 9250) transport for encrypted DNS on port 853, with DoT and DoH comparison and adoption notes.

• DNS over TLS vs DNS over HTTPS

  Reference guide

  Compare DNS over TLS and DNS over HTTPS, their ports, use cases, and how each protects DNS queries from snooping.

• DNS propagation and record resolution

  Reference guide

  How DNS lookup works in order, the record types you will meet, what propagation really means, and how to test whether DNS is the problem.

• DNS rebinding attacks and how browsers prevent them

  Reference guide

  DNS rebinding attacks use fast-changing DNS to reach private networks. Browsers enforce Local Network Access (LNA) to gate these requests.

• DNS record types reference

  Reference guide

  DNS record types reference covering A, AAAA, CNAME, MX, TXT, NS, SOA and CAA with example values and when each is used.

• DNS TTL explained

  Reference guide

  What DNS TTL means in seconds, how resolvers cache answers, and how to lower TTL before a migration to speed up propagation.

• DNSSEC explained and how to enable it

  Tutorial

  DNSSEC guide: what it protects, signing chain, DS records, key rollover, and how to enable it without breaking your zone.

• DS records and DNSSEC validation explained

  Reference guide

  DS records in DNSSEC: the parent-child trust chain, what DS contains, and how to add it when enabling DNSSEC.

• EDNS Client Subnet ECS explained

  Reference guide

  What EDNS Client Subnet (ECS) does per RFC 7871, including prefix length rules, caching scope, and the privacy trade-offs around client subnet data.

• Encrypted Client Hello explained

  Reference guide

  Learn what Encrypted Client Hello (ECH) does, how it protects SNI in TLS 1.3, and how it affects sites and networks.

• Free SSL certificates with Let's Encrypt

  Tutorial

  How to install a free Let's Encrypt SSL certificate, validate the domain, run certbot, and automate the 90 day renewal.

• How the SSL and TLS handshake works

  Reference guide

  How the SSL and TLS handshake works, step by step, from ClientHello to finished messages, cipher suites, certificates and TLS 1.3.

• HSTS header and secure transport

  Reference guide

  HSTS header guide: what Strict-Transport-Security does, the max-age and includeSubDomains flags, preload, and safe rollout steps.

• HSTS preload and the preload list

  Reference guide

  HSTS preload explained, how the preload list works and differs from the header, and whether your site should be added.

• How to redirect HTTP to HTTPS

  Tutorial

  How to redirect HTTP to HTTPS with a 301, covering .htaccess, Nginx, WordPress and Cloudflare, plus redirect loop troubleshooting.

• Let's Encrypt certificate rate limits

  Reference guide

  The Let's Encrypt rate limits for certificate issuance, orders and duplicate sets, and how to avoid hitting them.

• Mixed content warnings and how to fix them

  Troubleshooting guide

  What mixed content warnings mean, which resources browsers block, and the step by step fix for every http request on an https page.

• Multiple domains on one SAN SSL certificate

  Reference guide

  SAN (multi-domain) SSL certificates explained: which names one cert covers, wildcard limits, and the renewal gotchas.

• OCSP stapling and certificate revocation

  Reference guide

  OCSP stapling explained, how it proves a certificate is not revoked, and how browsers now prefer newer revocation checks.

• SPF, DKIM and DMARC records

  Tutorial

  SPF, DKIM and DMARC explained with real record examples, and how to add them so your email lands in the inbox and not spam.

• SSHFP records to verify SSH host keys

  Tutorial

  Publish SSHFP DNS records so SSH clients can verify a host key via DNSSEC instead of trusting on first use.

• SSL certificate formats and conversion

  Reference guide

  How PEM, DER, PKCS12 and PFX certificates differ and how to convert between formats with OpenSSL.

• SSL certificate renewal checklist

  Troubleshooting guide

  A step by step SSL certificate renewal checklist covering expiry checks, automation, DNS, and a post-renewal HTTPS test.

• SSL certificate types explained

  Reference guide

  SSL certificate types explained, from DV OV EV validation classes to wildcard and multi-domain coverage, and how to choose the one your site needs.

• SSL and HTTPS for WordPress

  Troubleshooting guide

  How to enable SSL and force HTTPS in WordPress, fix redirect loops and mixed content, and update the URLs so the padlock holds.

• SSL and TLS certificate errors

  Troubleshooting guide

  Understand SSL and TLS certificate errors, from hostname mismatch and expiry to mixed content and Cloudflare SSL mode, with the fix for each.

• SVCB and HTTPS records for service parameters and connection hints

  Reference guide

  SVCB and HTTPS DNS records: what they advertise (ALPN, ports, priorities) and how HTTPS + connection hints extend DNS with config.

• TLS 1.0 and TLS 1.1 are no longer supported

  Reference guide

  Browsers removed TLS 1.0 and 1.1 in 2020 to 2021, and here is how to check and disable them on your server.

• TLS 1.3 handshake explained

  Reference guide

  TLS 1.3 handshake explained: fewer round trips, the 0-RTT option, and how to verify a connection uses TLS 1.3.

• Root, intermediate and leaf certificates explained

  Reference guide

  Root, intermediate and leaf certificates in the TLS chain of trust, plus how to inspect and avoid chain problems.

• TLS client certificates for website access

  Reference guide

  TLS client certificates explained: mutual TLS, how servers request a client cert, and how to issue, renew and revoke them.

• TLS handshake failures troubleshooting

  Troubleshooting guide

  Troubleshoot TLS handshake failures by layer: protocol, cipher, certificate, and server configuration, with browser and log evidence.

• Protecting your TLS private key

  Tutorial

  Protect a TLS private key, set the right file permissions, and know when a compromised key needs reissue.

• TLS session resumption and the handshake cost

  Reference guide

  TLS session resumption explained, tickets and session IDs, and how resumption reduces TLS handshake latency on repeat connections.

• Authoritative, recursive and root DNS servers

  Reference guide

  DNS server types explained, from root and TLD servers to authoritative nameservers and recursive resolvers, with the lookup order.