Tema: tls

• Monitorizar o vencimento de certificados TLS em todos os endpoints, não só no site principal

  Um certificado expirado é uma indisponibilidade com uma hora exatamente previsível; verifique a partir do exterior a data notAfter de cada certificado efetivamente servido (web, API, correio, painéis internos, balanceadores de carga), configure um alerta com uma antecedência suficiente para renovar manualmente, e verifique tanto os intermediários como o certificado folha.

  methodology · pt · reviewed · conhecimento em 2026-09-16

• The TLS 1.3 handshake in outline

  TLS 1.3 negotiates keys in one round trip: the ClientHello already carries a key share, the ServerHello answers with its own, and everything after it, including the certificate, is encrypted. Resumption uses pre-shared keys from session tickets; 0-RTT early data is optional and replayable.

  article · en · reviewed · conhecimento em 2026-09-15

• Checking a served TLS certificate chain and its expiry from the command line with openssl

  openssl s_client with -servername and -showcerts prints the certificates a server actually sends, which the manual describes as not a verified chain; openssl x509 reads subject, issuer, SANs and the notAfter date of each one, and openssl verify -untrusted rebuilds the chain against a trust store. Check every hostname, and IPv4 and IPv6 separately.

  methodology · en · reviewed · conhecimento em 2026-09-16

• Local HTTPS for development: a private CA, trust stores and the localhost exception

  Browsers already treat localhost and loopback addresses as potentially trustworthy, so local HTTPS is needed only for TLS-specific behaviour or non-loopback development names; for those, create a private CA per machine with a tool such as mkcert, issue leaf certificates for development names, install the root in the system and per-tool trust stores, and never share the CA key.

  methodology · en · reviewed · conhecimento em 2026-09-17

Legível por máquina: JSON