https://lukehebert.com/tag/ssl/Recent content in Ssl on Luke HebertHugoen-usTue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/ingress-and-ingress-controllers/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/ingress-and-ingress-controllers/An overview of Kubernetes Ingress resources and the controllers that fulfill them, covering terminology, creation, and prerequisites.https://lukehebert.com/post/kubernetes-tls-check-list/Sat, 16 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-tls-check-list/A practical checklist covering X.509 certificate requirements for Kubernetes nodes, users, and the API server. Includes deployment methods, cert-manager workflows, and Extended Key Usage configuration.https://lukehebert.com/post/java-tls-client-debugging/Mon, 19 May 2025 00:00:00 +0000https://lukehebert.com/post/java-tls-client-debugging/A guide to inspecting SSL/TLS handshakes in Java applications when built-in debugging is unavailable. Includes a lightweight TLS client tool for testing certificate and handshake issues.https://lukehebert.com/post/wireshark-filter-for-ssl-traffic/Fri, 30 Aug 2024 00:00:00 +0000https://lukehebert.com/post/wireshark-filter-for-ssl-traffic/A collection of useful Wireshark display filters for analyzing SSL/TLS handshake traffic, including a reference table of handshake message types and notes on cipher suite considerations.https://lukehebert.com/post/a-walkthrough-of-a-tls-1.3-handshake/Wed, 10 May 2023 00:00:00 +0000https://lukehebert.com/post/a-walkthrough-of-a-tls-1.3-handshake/A byte-by-byte walkthrough of a TLS 1.3 handshake using OpenSSL’s s_client, comparing each message to its TLS 1.2 counterpart. Highlights how encryption, key exchange, and extensions differ in the latest revision.https://lukehebert.com/post/the-following-error-occurs-when-restarting-an-apache-server/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/the-following-error-occurs-when-restarting-an-apache-server/A quick fix for the SSL Library Error 185090057 that appears when restarting Apache, caused by a malformed PEM certificate file. Learn how to validate and correct the certificate format to get your server back online.https://lukehebert.com/post/decode-certificate-csr/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/decode-certificate-csr/Quick openssl commands to inspect a Certificate Signing Request and an issued X.509 certificate in human-readable form.https://lukehebert.com/post/https-force-redirect/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/https-force-redirect/A quick Apache mod_rewrite snippet that forces all HTTP traffic to HTTPS, plus context on where to place it and what to watch for.https://lukehebert.com/post/deploy-cfssl-ca-server/Mon, 02 Aug 2021 00:00:00 +0000https://lukehebert.com/post/deploy-cfssl-ca-server/A step-by-step guide to deploying a CFSSL-backed certificate authority with PostgreSQL storage, OCSP responder, and CRL distribution. Covers installation, CA initialization, service configuration, and Nginx reverse proxy setup.https://lukehebert.com/post/ldaps-and-unicodepwd/Tue, 01 Dec 2020 00:00:00 +0000https://lukehebert.com/post/ldaps-and-unicodepwd/LDAPS is a hard requirement when setting passwords via unicodePwd on Active Directory. Non-TLS connections are rejected by AD itself, and SASL is not a supported alternative.https://lukehebert.com/post/what-is-the-significance-of-the-version-field-in-a-tls-1-1-clienthello-message/Tue, 04 Dec 2018 00:00:00 +0000https://lukehebert.com/post/what-is-the-significance-of-the-version-field-in-a-tls-1-1-clienthello-message/The version field in a TLS ClientHello message tells the server the highest protocol version the client supports, but it appears in three distinct places with different roles. Understanding where and how each version field is used helps troubleshoot handshake failures and interoperability issues with legacy implementations.https://lukehebert.com/post/match-a-tls-certificate-with-its-private-key/Tue, 21 Nov 2017 00:00:00 +0000https://lukehebert.com/post/match-a-tls-certificate-with-its-private-key/Lose track of which private key pairs with which certificate? Use OpenSSL to compare public key hashes and confirm the match in seconds.https://lukehebert.com/post/java-sslhandshakeexception-no-cipher-suites-in-common/Mon, 21 Aug 2017 00:00:00 +0000https://lukehebert.com/post/java-sslhandshakeexception-no-cipher-suites-in-common/A common Java SSL handshake failure stems from passing a null KeyManager array when initializing the SSLContext, which silently disables all certificate-based cipher suites. This post walks through the root cause and the four most frequent triggers behind the error.https://lukehebert.com/post/handling-multiple-cns-on-a-single-certificate/Fri, 18 Aug 2017 00:00:00 +0000https://lukehebert.com/post/handling-multiple-cns-on-a-single-certificate/Multiple CNs in a certificate Subject field are deprecated and cause compatibility failures. The SAN extension is the correct way to cover multiple names on a single certificate.https://lukehebert.com/post/server-is-unwilling-to-perform-53/Wed, 16 Aug 2017 00:00:00 +0000https://lukehebert.com/post/server-is-unwilling-to-perform-53/LDAP error 53 means the destination server is refusing a password change request. This post walks through the most common Active Directory requirements and policy settings that trigger the error.https://lukehebert.com/post/aes-ni-encryption-in-flight-for-hdfs/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/aes-ni-encryption-in-flight-for-hdfs/Configure AES-NI accelerated encryption in transit for HDFS by setting the cipher suite and key length in hdfs-site.xml on both the NameNode/DataNode and client sides.https://lukehebert.com/post/check-entropy-levels-on-linux/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/check-entropy-levels-on-linux/Learn how to check and interpret the kernel entropy pool on Linux, why low entropy can slow down SSL handshakes and SSH sessions, and what to do when the pool runs dry.https://lukehebert.com/post/checking-aes-ni-availability/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/checking-aes-ni-availability/A quick reference for verifying AES-NI hardware acceleration across Java, OpenSSL, and the CPU itself. Includes benchmark commands to confirm the instruction set is actually being used.https://lukehebert.com/post/jvm-ssl-debug/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/jvm-ssl-debug/Enable verbose SSL/TLS handshake logging in a JVM running Hadoop or Cloudera services to diagnose certificate and protocol issues.https://lukehebert.com/post/ssl-certificate-debugging-openssl-s-client/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/ssl-certificate-debugging-openssl-s-client/A practical cheat sheet of openssl s_client commands for inspecting, verifying, and troubleshooting SSL certificates in production environments.