NetBay journal

DNS & TLS

14 practical DNS & TLS articles from Netbay Engineering — written for operators running Linux and Windows VPS in India.

14 articles in this topic

Hardening TLS Configurations: OCSP Stapling, Forward Secrecy, and Cipher Priorities

Achieve an SSL Labs A+ rating by enforcing modern TLS 1.3 cipher suites, preloading HSTS headers, and configuring reliable OCSP stapling.

DNS & TLS2026-10-298 min read

Implementing DNSSEC with BIND9: Zone Signing, Key Rollovers, and DS Validation

Protect your domain from DNS spoofing and cache poisoning by generating KSK/ZSK key pairs, signing BIND9 zones, and publishing DS records at your registrar.

DNS & TLS2026-10-267 min read

Automating Wildcard TLS Certificates with Let's Encrypt DNS-01 and Certbot Hooks

Issue and automatically renew wildcard SSL/TLS certificates using Certbot DNS-01 validation scripts without exposing port 80 to the internet.

DNS & TLS2026-10-236 min read

Designing Split-Horizon Authoritative DNS Zones for Private Cloud VPS

Architect split-horizon DNS zones that serve internal private IP addresses to authenticated VPS peers while publishing public records to the internet.

DNS & TLS2026-10-205 min read

Diagnose Certificate Errors: Chain, Clock, Name Mismatch

Diagnose HTTPS errors by chain, clock skew, and name mismatch using openssl and browser clues before you reissue a certificate that already works.

DNS & TLSAugust 5, 20268 min read

Wildcard Certificates: When They Help and Hide Mistakes

Decide when a wildcard certificate helps on a VPS and when it hides hostname mistakes, extra names, and the extra ACME DNS-01 operational cost.

DNS & TLSJuly 14, 20267 min read

TLS 1.2 and 1.3 Cipher Hygiene Without SSL Labs Cargo Cult

Tune TLS 1.2 and 1.3 plus ciphers for nginx without cargo-cult SSL Labs chasing, and read a test grade as a checklist rather than a trophy hunt.

DNS & TLSJune 25, 20268 min read

Auto-Renewal Failures: What Breaks When Certbot Stops

Set certbot auto-renewal that actually reloads nginx, then learn the ports, timers, and disk failures that silently leave you with an expired cert.

DNS & TLSJune 8, 20268 min read

HTTP-01 vs DNS-01: Choosing an ACME Challenge

Compare HTTP-01 and DNS-01 ACME challenges, pick the one that fits nginx on a VPS versus wildcards, and avoid the common failure modes of each.

DNS & TLSMay 20, 20268 min read

Let's Encrypt with Certbot and Nginx on Ubuntu

Issue a Let's Encrypt certificate with certbot and nginx on Ubuntu, complete HTTP-01, and wire the live cert into a working TLS server block.

DNS & TLSMay 6, 20268 min read

CAA Records So Only Your Certificate Authority Can Issue

Add CAA records so only the certificate authority you choose can issue for your domain, then verify that policy before the next ACME issuance.

DNS & TLSApril 22, 20267 min read

TTL, Propagation, and Why DNS Changes Are Not Instant

Understand TTL, resolver caches, and glue so a DNS edit is not instant, and learn how to change records without hours of surprise downtime later.

DNS & TLSApril 9, 20267 min read