Distrust a Root CA That Ubuntu Ships
Stop trusting one root that Ubuntu's ca-certificates ships. Mark it with ! in one file, prove the change with openssl verify, then find the copies it misses.
#openssl
Filtering by topic #openssl · clear
Add Your Own CA to Ubuntu's Trust Store
Create a private CA with openssl, sign a leaf certificate, then install the root in /usr/local/share/ca-certificates so Ubuntu trusts your internal HTTPS.
mTLS: client certificates with nginx
Lock an admin panel behind mTLS: build a private CA with openssl, issue client certificates, and configure nginx to refuse anyone without one.
Self-signed certificates on Ubuntu, done right
Mint a self-signed TLS cert Chrome actually accepts on Ubuntu 24.04: one openssl command with SAN, nginx/Apache wiring, and trusting it without curl -k.
AES-NI on a VPS: Check and Restore It
Check whether your VPS exposes AES-NI, measure what a masked CPUID costs your AES-GCM throughput, and force the bits back on with OPENSSL_ia32cap.