tls

A practical guide to setting up a simple web server using bozohttpd on NetBSD, including configuration via inetd, HTTPS with acme-client, and optional multi-site setup.

Sula is a Gemini protocol server written in Scryer Prolog, featuring TLS via rustls, content negotiation, and graceful shutdown, but requires a patched Scryer Prolog build.

RFC 9851 declares TLS 1.2 to be in feature freeze, allowing only urgent security fixes, new exporter labels, and new ALPN protocol IDs, while encouraging migration to TLS 1.3.

This article explains how to use the Hurricane Electric BGP tool to find domains bound to neighbor IP segments, and filter those supporting TLS 1.3 and 1.2 for use as reality disguise domains, adapting traffic type based on site content (text-only or media).

An in-depth explanation of TLS certificate validation on Linux, covering trust stores, chain building, and common pitfalls such as missing intermediates. The article clarifies why different tools may disagree on certificate validity.

Explains how to set up TLS certificates for internal services using split-horizon DNS, a VPN with DNS resolver, and ACME clients like acme.sh with Let's Encrypt, providing a practical alternative to self-signed certificates.

The article criticizes the IETF for evading responsibility in its handling of the non-hybrid TLS-ML-KEM standard, focusing on the organization's accountability in cryptographic standardization.

The article discusses the problem of authentication token theft by infostealer malware and explores a 15-year-old proposal by Dirk Balfanz to use self-signed client certificates for TLS mutual authentication to bind tokens to a specific device, preventing token reuse even if stolen.

This blog post explores a subtle bug in Go's X.509 certificate verification where two seemingly identical CA certificates may lead to different results due to differences in PEM encoding whitespace handling.

Let's Encrypt announces plans to adopt Merkle Tree Certificates for post-quantum authentication, addressing the growing urgency to migrate to post-quantum signatures in the Web PKI.

An analysis and reproduction of lawful TLS wiretapping using ACME automation, based on a real incident involving Russian XMPP service Jabber.ru, demonstrating how certificate-based intercepts can be implemented and detected.

This article describes how to set up a private FreeBSD package repository secured with mutual TLS, including creating a custom certificate authority and configuring nginx to require client certificates.