#tls

Four expired certificates, an EOL distro and no package manager help. How to take HTTPS renewal back with acme.sh, keep the existing vhosts untouched, and monit

A deep dive into the TLS 1.3 handshake: why it's 1-RTT by default, how PSK resumption replaces session tickets, the 0-RTT replay tradeoff, and what developers actually need to configure.

Chrome drops emSign ECC Root CA - G3 on October 27. I read the CA bundles in 30 popular Docker images: a third still ship the root, some built after the fix.

If you've ever tried to make an HTTP client "look like Chrome" to get past a WAF, you've probably...

Why Encrypted Client Hello Matters for TLS Privacy Transport Layer Security (TLS) is the...

TL;DR ML-DSA-65 at TLS 1.3 is production-ready today. Hybrid KEM (X25519MLKEM768) too....

Everyone knows the padlock means "encrypted". Fewer people know what it leaves out. When your...

Four high-severity Node.js fixes from 21 October 2026: a Brotli decoder out-of-bounds write and three hostname-verification bugs, plus what the end-of-life branches mean for your dependency graph.

LibreSSL 4.4 arrives as the first stable 4.4.x release, featuring X25519MLKEM768 as the preferred hybrid key exchange for TLS 1.3 via libtls, certificate b

Browsers moved fast on the eMudhra emSign G3 incident. Your Go services, Python scripts and Docker...

𝗛𝗲𝗿𝗲'𝘀 𝘄𝗵𝗮𝘁 𝗖𝗩𝗘-𝟮𝟬𝟮𝟲-𝟭𝟭𝟭𝟵𝟰𝟯 𝗺𝗲𝗮𝗻𝘀 𝗳𝗼𝗿 𝘆𝗼𝘂𝗿 𝗚𝗼 𝘀𝗲𝗿𝘃𝗶𝗰𝗲𝘀 Go 1.27.3 and 1.26.10 shipped this week with...

A browser patch is only one piece of certificate trust. Here is a practical way to check the other...