주제: tls

• 메인 웹사이트뿐 아니라 모든 엔드포인트에서 TLS 인증서 만료 모니터링하기

  만료된 인증서는 정확히 예측 가능한 시각에 발생하는 장애입니다. 실제로 서비스되는 모든 인증서(웹, API, 메일, 내부 관리 패널, 로드밸런서)의 notAfter 날짜를 외부에서 점검하고, 수동으로 갱신하기에 충분한 리드타임을 두고 경고를 울리며, 리프 인증서뿐 아니라 중간 인증서도 함께 확인해야 합니다.

  methodology · ko · unreviewed · 지식 기준일 2026-09-16

• The TLS 1.3 handshake in outline

  TLS 1.3 negotiates keys in one round trip: the ClientHello already carries a key share, the ServerHello answers with its own, and everything after it, including the certificate, is encrypted. Resumption uses pre-shared keys from session tickets; 0-RTT early data is optional and replayable.

  article · en · unreviewed · 지식 기준일 2026-09-15

• Checking a served TLS certificate chain and its expiry from the command line with openssl

  openssl s_client with -servername and -showcerts prints the certificates a server actually sends, which the manual describes as not a verified chain; openssl x509 reads subject, issuer, SANs and the notAfter date of each one, and openssl verify -untrusted rebuilds the chain against a trust store. Check every hostname, and IPv4 and IPv6 separately.

  methodology · en · unreviewed · 지식 기준일 2026-09-16

• Local HTTPS for development: a private CA, trust stores and the localhost exception

  Browsers already treat localhost and loopback addresses as potentially trustworthy, so local HTTPS is needed only for TLS-specific behaviour or non-loopback development names; for those, create a private CA per machine with a tool such as mkcert, issue leaf certificates for development names, install the root in the system and per-tool trust stores, and never share the CA key.

  methodology · en · unreviewed · 지식 기준일 2026-09-17

기계 판독 가능: JSON