pqc-bench Part 2: Where the X25519MLKEM768 overhead actually matters
Part 1 ran a fresh-handshake load test on a Graviton3 and measured what the ML-KEM half of X25519MLKEM768 adds to TLS 1.3 handshake latency. The hea…
Open Source
⚑ Сообщить о проблемеПоследние новости Open Source от Tech News
Все темы
AI
agents
ai
api
architecture
automation
backend
beginners
career
database
devchallenge
devops
discuss
javascript
linux
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
Certificate name verification: wildcards, SANs and the checks that fail open
Certificate name verification: wildcards, SANs and the checks that fail open Identity is a separate question from trust A certificate chain can be v…
GitHub Just Killed SHA-1 Over HTTPS
On September 15, 2026, GitHub turned off SHA-1 for HTTPS and TLS on github.com and its CDNs. They had been warning about it since April. If your cli…
Как плагин обновлений Tauri ломает HTTPS на ALT Linux
Приложение на Tauri 2 проходит все тесты на Ubuntu, а на ALT Linux теряет HTTPS сразу после проверки обновлений. Разбираю, почему так происходит, ка…
TLS Handshakes and OAuth Flows Are Easier to Learn by Clicking Through Them
There are two security flows every backend developer is supposed to know cold and almost everyone half-remembers: the TLS handshake and the OAuth au…
«CT-log» — это самый частый сценарий, почему имя остается в открытом доступе, даже если его нет в DNS
Проверял, что видно про домен заказчика снаружи, и выписал имена из журналов Certificate Transparency. В списке оказались jenkins , gitlab-runner и…
От Root CA до User Authorization в nginx+apache. Часть 3. Вход по клиентскому сертификату: прокси или приложение
В первой части я обещал беспарольный вход в админку. Здесь он наконец заработал. Что внутри: — mTLS в nginx и apache: все директивы, все переменные…
Stop saying SSL: TLS only does three jobs, and your 'SSL cert' is usually not the outage
Runbooks still say "renew the SSL certificate" when the browser warning is obsolete protocol . The certificate can be brand new. The tunnel is still…
NET::ERR_CERT_AUTHORITY_INVALID: When the Root Itself Is Not Trusted
The hostname matches. The chain is complete — every intermediate is present, each certificate signs the next, and it all leads up to a single certif…
Automatic HTTPS on Kestrel in 2026, now that LettuceEncrypt is archived
If you run an ASP.NET Core app directly on Kestrel, with no nginx or cloud load balancer in front, getting a real TLS certificate has always been th…
The Kafka Incident That Was Just a Certificate (And the Operator That Saved MirrorMaker)
A Saturday afternoon alert: under-replicated partitions on the production Kafka cluster, well over the threshold. Status CRITICAL, replicas out of s…
Deploying Gateway API with TLS Encryption on Kubernetes
The Kubernetes Gateway API is the successor to Ingress, a more expressive, role-oriented resource model ( GatewayClass , Gateway , HTTPRoute ) for a…
When TLS 1.3-only broke everything behind Akamai
The alert wasn't subtle. Requests just stopped hitting our backend nginx box. Internal traffic from our own domains kept flowing, but anything comin…
Deploying cert-manager and Managing SSL Certificates in Kubernetes
cert-manager is the standard Kubernetes add-on for automated TLS certificate issuance and renewal. It integrates with ACME-based authorities such as…
gost-curl — консольный HTTP-клиент с поддержкой ГОСТ TLS 1.3
Недавно мне понадобился консольный HTTP-клиент для отладки сайта, который закрыт TLS 1.3 на ГОСТ-алгоритмах. Из доступных средств почти не было вари…
Strimzi: Create a simple Mutual TLS (mTLS) authentication
You probably already know about Strimzi . Strimzi enables Kafka on Kubernetes , simple as that. So, in this post, I will not talk about Strimzi , bu…
TLS Is Easy to Enable and Hard to Get Right
Enabling TLS is a solved problem. Get a certificate from Let's Encrypt, point your server at it, done. What's not solved is the configuration that c…
Что именно сломалось: разбираем блокировки РКН/ТСПУ по слоям сетевого стека. Rkn Block Checker
У вас не открывается сайт. Браузер пишет «Не удалось установить соединение». Это всё, что он знает — и это бесполезно. Потому что «не открывается» -…
Why Subject Alternative Names (SANs) Matter for Modern Browsers
Originally published on cert-depot.com . Free, open-source self-signed certificate generator — no signup, keys never stored. Why Subject Alternative…