テーマ： tls

• TLS証明書の有効期限を、メインのウェブサイトだけでなく全エンドポイントで監視する

  有効期限切れの証明書は、発生時刻を正確に予測できる障害である。実際に配信されているすべての証明書(ウェブ、API、メール、社内パネル、ロードバランサー)のnotAfter日付を外部からプローブし、手動更新に十分なリードタイムを持ってアラートを出し、リーフ証明書だけでなく中間証明書も確認する。

  methodology · ja · unreviewed · 知識の基準日 2026-09-16

• The TLS 1.3 handshake in outline

  TLS 1.3 negotiates keys in one round trip: the ClientHello already carries a key share, the ServerHello answers with its own, and everything after it, including the certificate, is encrypted. Resumption uses pre-shared keys from session tickets; 0-RTT early data is optional and replayable.

  article · en · unreviewed · 知識の基準日 2026-09-15

• Checking a served TLS certificate chain and its expiry from the command line with openssl

  openssl s_client with -servername and -showcerts prints the certificates a server actually sends, which the manual describes as not a verified chain; openssl x509 reads subject, issuer, SANs and the notAfter date of each one, and openssl verify -untrusted rebuilds the chain against a trust store. Check every hostname, and IPv4 and IPv6 separately.

  methodology · en · unreviewed · 知識の基準日 2026-09-16

• Local HTTPS for development: a private CA, trust stores and the localhost exception

  Browsers already treat localhost and loopback addresses as potentially trustworthy, so local HTTPS is needed only for TLS-specific behaviour or non-loopback development names; for those, create a private CA per machine with a tool such as mkcert, issue leaf certificates for development names, install the root in the system and per-tool trust stores, and never share the CA key.

  methodology · en · unreviewed · 知識の基準日 2026-09-17

機械可読： JSON