mTLS: client certificates with nginx
Lock an admin panel behind mTLS: build a private CA with openssl, issue client certificates, and configure nginx to refuse anyone without one.
TLS & certificates
HTTPS on your own server: how certificates are issued, how renewal works, and why a site starts serving an expired certificate even though renewal succeeded.
Filtering by topic #tls · clear
nginx Reverse Proxy Config, Explained
Build an nginx reverse proxy server block line by line: proxy_pass, the four headers your app needs, websockets, trailing slashes, and uploads.
Add Your Own CA to Ubuntu's Trust Store
Create a private CA with openssl, sign a leaf certificate, then install the root in /usr/local/share/ca-certificates so Ubuntu trusts your internal HTTPS.
Nginx vs Caddy vs Traefik: pick a proxy
Three services, one VPS, one public IP. How Nginx, Caddy and Traefik differ on certificates, config cost per app, websockets and Docker routing.
Certbot wildcard certificates with DNS-01
Issue a wildcard certificate with Certbot using the DNS challenge. How the TXT record proof works, which plugin to install, and how renewal stays automatic.
Install Certbot for Apache on Ubuntu 24.04
One command gives Apache a free Let's Encrypt cert on Ubuntu 24.04. Skip snap: apt ships Certbot 2.9.0. Plus the ServerName trap that blocks issuance.
Self-signed certificates on Ubuntu, done right
Mint a self-signed TLS cert Chrome actually accepts on Ubuntu 24.04: one openssl command with SAN, nginx/Apache wiring, and trusting it without curl -k.
Self-host Rocket.Chat with Docker Compose
Self-host Rocket.Chat on a VPS with Docker Compose: the single-node MongoDB replica set it requires, TLS, backups, and every failure mode fixed.
Traefik reverse proxy: 5 apps, one Compose file
Run five apps behind one IP with Traefik v3 on Docker Compose: routing by Host rule, automatic Let's Encrypt TLS, and the acme.json trap that blocks startup.
Install Certbot for nginx on Ubuntu 24.04
sudo apt install certbot python3-certbot-nginx, then one certbot --nginx run for a Let's Encrypt cert. Plus apt vs snap and the port 80 renewal timeout.