Tls
guest@6admin.io:~$ ls ~/tags/tls
An IDS probe cannot see TLS
Suricata labs built on plain HTTP are excellent for teaching, but they hide a major blind spot once in production: encryption. A promiscuous probe sees TLS and can inspect nothing. Where to place inspection instead.
Doing internal ACME without begging the AD CS team
Step-ca, acme2certifier or OpenBao? Three families and the choice depends first on what you already run, then on who must remain the issuer.
A reverse proxy in front of Perforce, or not: the pros and cons
Four ways to put TLS in front of a Perforce server and what each one costs: nginx layer-4 termination, p4d native TLS, SNI passthrough and the in-house tools P4Broker and P4P. With the client-IP trap everyone forgets.
Nginx in front of Perforce: layer-4 TLS termination and the P4 protocol
Putting nginx in TLS termination in front of a Perforce server: why the stream module and not an HTTP proxy, what the P4 protocol imposes and the keepalive and timeout tuning without which long sessions get cut on multi-hour syncs.
Inbound traffic: expose less and guard what is left
Securing inbound traffic: firewall, minimal exposure, reverse proxy and clean TLS termination.
Haproxy: the reverse proxy that took over from Pound
After Pound (the 2008 article), the floor above: haproxy 1.3, TCP and HTTP modes, ACLs, backends and health checks, the stats page. What a reverse proxy must know how to do before being credible.
Pound: a very light reverse proxy
Pound, the reverse proxy that terminates TLS and balances to a pool, before haproxy took over.
SSLH: ssh and https on the same port
A 2007 memo: sslh multiplexes ssh and https on port 443, the only port of paranoid firewalls. How it works, what it allowed and why (edit 2026) nobody would put it in production today.