Transport Layer Security, certificates, encryption, handshakes and network security best practices.
6 articles
Cloudflare has applied to Chrome, Apple, Microsoft and Mozilla, and signed an agreement to acquire a GlobalSign root. It does not issue any certificates yet. Its first post-quantum certificates (Merkle Tree) are targeted for early 2027, announced as free, via ACME, and reserved for clients that support ARI.
Persistent DNS validation does not guarantee renewals without intervention. Here is its status on October 11, 2026 with draft -02, its limitations and the criteria for deciding whether it suits your TLS setup.
Fleet inventory, enterprise ACME, endpoints no script can reload, Let's Encrypt rate limits and DCV reuse: the field playbook for SSL certificate renewal automation across 50 to 1,000 certificates.
Inventory, issuance, deployment, renewal, revocation, monitoring: the 6 phases of the certificate lifecycle, ACME/ARI automation, and an action plan to keep up with 47-day renewals.
Everything about the CAA DNS record: syntax, issue/issuewild/iodef tags, critical flag, inheritance, RFC 8659 and 8657, multi-provider setup, and auditing.
HSTS (RFC 6797) forces browsers to contact your site only over HTTPS. This guide covers the protocol, the directives, per-stack configurations and how to submit to the Chrome preload list.