Let's Encrypt

This post looks at several different ways to automate cert renewal. I tried to cater to everyone by including cron and systemd options. If you don't have your server set up to send emails, you might want to do that first.

This post wraps up (most of) the server config and puts it to use. It covers my approach to generating a cert, and provides some useful openssl commands for verification. Most of the work here is simply shuffling files around.

This post looks a collection of useful security headers. I've tried to explain what each one does, where it can be helpful, and where it might bite you. None of these are absolutely necessary; if nothing else I strongly recommend using HSTS.

This post sets up all the backend security logic (minus headers). I've tried to provide an explanation of each component and good values to use (or the means to create your own). If you don't have OpenSSL, most of this is meaningless.

This post is a catch-all for items that aren't closely related to the other major tasks. It covers good resources, certbot installation, and my approach to reusing Let's Encrypt config.

This post begins with the sad state of affairs that is the current US internet landscape but quickly moves on to more interesting topics like background information on HTTP, HTTPS, HSTS, Let's Encrypt, and `certbot`.