NETWORK NOTES

TLS and certificates

TLS encrypts a connection and lets a client verify the identity of a server. A certificate must cover the requested name, be within its validity period and chain to a trusted issuer.

Server Name Indication

SNI supplies the requested hostname during the handshake. It lets a server choose the appropriate certificate when several domains share one address.

Inspect without bypassing validation

openssl s_client -connect example.com:443 \
  -servername example.com -verify_return_error

A valid certificate is one part of the check. Confirm the hostname, trust chain and response from the application as well. Do not disable verification to hide a certificate error.

Renewal

Certificates have finite lifetimes. Renewal should be automated and tested before expiration; the serving process must load the renewed files.