Topic
Let's Encrypt
Setting Up Nextcloud Talk on TrueNAS with Custom Domain for Private Family Calls
Other
Russian Websites Remain Dependent on Foreign SSL Certificates and Analytics Despite Sanctions
Policy & Regulation
Deploying Self-Hosted Hysteria 2 Proxy on Debian-Based Linux VPS via Terminal
OtherSecure Custom Domain Setup for Client Status Pages Using CNAME, Certbot and Go Instead of ACME On-Demand
A detailed case study describes how a monitoring service implemented white-label status pages on customer domains without relying on ACME on-demand certificate issuance. The approach uses pre-validated domains stored in a database, background DNS checks via CNAME or A-record matching, and a root helper script running on a systemd timer to handle certbot issuance and nginx configuration. Key design choices separate privileges so the Go application never touches certificates or nginx directly, while loopback endpoints are protected against proxy header spoofing. The solution explicitly addresses risks such as DoS through malicious Host headers exhausting Let's Encrypt rate limits, private key exposure, and first-visitor latency during TLS handshakes. Hysteresis in DNS status prevents temporary resolution glitches from disabling active customer pages. The entire implementation stays under a few hundred lines of code and runs reliably on a single server with nginx in front of the Go application.
TSPU Filtering Disrupts Timeweb Cloud Servers: Diagnosis, CDN Failures, and Reverse Proxy Bypass
Russian hosting provider Timeweb Cloud experienced widespread TSPU-based DPI filtering starting in early June that selectively blocked TLS handshakes on port 443 while leaving SSH, ICMP, and TCP connectivity intact. The issue affected multiple providers including Beget and Selectel, was publicly acknowledged by Timeweb on June 5, and proved highly variable by region, operator, and time of day. Attempts to mitigate via new IP addresses or Timeweb's own CDN failed due to poisoned caches and platform outages, while Yandex Cloud CDN blocked all POST requests required for WordPress functionality. A working solution involved deploying a minimal nginx reverse proxy on another Russian cloud VPS that preserves full HTTP methods, handles certificate synchronization, and routes ACME challenges correctly. Timeweb support later closed tickets without resolution after requesting ineffective mtr traces that cannot detect DPI behavior. The case highlights systemic challenges in diagnosing state-mandated filtering and the limitations of standard network diagnostics against selective TLS interference.
Building Trusted TLS in Kubernetes Without InsecureSkipVerify Using cert-manager and trust-manager
The article explains how to establish verifiable TLS across a Kubernetes cluster running on Talos with Cilium networking and Linstor storage, eliminating reliance on InsecureSkipVerify flags. It details the creation of an internal self-signed CA via cert-manager, using a selfSigned bootstrap issuer to generate the CA certificate before deploying a production ClusterIssuer. trust-manager then distributes only the public CA bundle as ConfigMaps across all namespaces, allowing workloads to validate certificates without exposing private keys. For external services, an ACME issuer integrates with Let's Encrypt and Gateway API to automate HTTP-01 challenges. The guide also covers kubelet server certificate rotation through serverTLSBootstrap and the kubelet-serving-cert-approver controller, which validates CSR requests against Node objects before approval. These steps ensure mutual trust for internal services, publicly trusted certificates for internet-facing endpoints, and verified kubelet connections for the API server and monitoring systems.