NetBay journal

DNS & TLS

10 practical DNS & TLS articles from Netbay Engineering — written for operators running Linux and Windows VPS in India.

10 articles in this topic

Diagnose HTTPS errors by chain, clock skew, and name mismatch using openssl and browser clues before you reissue a certificate that already works.

Decide when a wildcard certificate helps on a VPS and when it hides hostname mistakes, extra names, and the extra ACME DNS-01 operational cost.

Tune TLS 1.2 and 1.3 plus ciphers for nginx without cargo-cult SSL Labs chasing, and read a test grade as a checklist rather than a trophy hunt.

Set certbot auto-renewal that actually reloads nginx, then learn the ports, timers, and disk failures that silently leave you with an expired cert.

Compare HTTP-01 and DNS-01 ACME challenges, pick the one that fits nginx on a VPS versus wildcards, and avoid the common failure modes of each.

Issue a Let's Encrypt certificate with certbot and nginx on Ubuntu, complete HTTP-01, and wire the live cert into a working TLS server block.

Add CAA records so only the certificate authority you choose can issue for your domain, then verify that policy before the next ACME issuance.

Understand TTL, resolver caches, and glue so a DNS edit is not instant, and learn how to change records without hours of surprise downtime later.

Point a domain at a VPS with the right A and AAAA records, skip CNAME-at-apex traps, and keep mail plus ACME working after you cut over DNS.

Map A, AAAA, CNAME, MX, and TXT records to real traffic so your domain reaches the VPS, mail still works, and ACME can prove you own the name.