Internal CA Trust Is an Operator Onboarding Problem
A valid internal TLS certificate is still unusable on a new operator device until its trust root is installed correctly.
TLS
Certificate Expiry Is an Availability Signal
TLS can work perfectly today and still have a known future outage date embedded in the certificate.
HTTPS Latency Needs More Than One Number
A single total probe duration hides whether slowness came from name resolution, TCP connection, TLS negotiation or server response.
TLS Protected My SIP Signaling, Not My RTP
A secure SIP transport and encrypted media are separate decisions. TLS can protect signaling while RTP remains completely visible on the wire.
Why 0600 Was Too Strict for a Containerized Private Key
The strictest-looking file mode is not automatically the safest usable mode when a non-root service must read the key.
HTTP/3 in Enterprise Networks: QUIC Broke the Old Inspection Assumptions
Blocking UDP/443 is not merely a firewall rule. QUIC moves transport, security, streams, and connection identity into a model that old TCP/TLS inspection architectures were not designed around.
A Public CA File Can Be Unreachable Behind a 0700 Parent Directory
Publishing a certificate means every directory in its path must support the intended reader, even if neighboring secrets remain private.
The TLS Key Existed, but OpenBao Still Could Not Read It
A file can have the right contents and still be unusable when directory traversal or group permissions are wrong.
Split-Horizon DNS: One Hostname, Two Network Paths, and a Lot of TLS Confusion
The same hostname can resolve to a local reverse proxy on LAN and a Cloudflare Tunnel externally. That is clean when DNS, SNI, certificates, and origin routing agree—and maddening when one layer quietly takes the other path.
SIP over TLS: The Certificate Error Was More Useful Than the Green Lock
Moving SIP signaling to TLS exposed certificate names, trust chains and transport assumptions that UDP had allowed me to ignore.
Caddy Can Reach the HTTPS Upstream and Still Fail the TLS Handshake
An IP can be the correct route to an upstream while being the wrong identity for its certificate.
TLS Key Custody Is Part of the OpenBao Root of Trust
The server needs its TLS private key to operate, while the CA private key is more powerful and should remain off-host.