Blog

ECDSA P-256 is the right default for new certificates: much smaller keys and signatures, and far faster signing. RSA earns its place as a fallback for legacy clients. Here are the measured numbers, the openssl commands, and a dual-certificate nginx config.

A wildcard covers every subdomain from one key; a multi-SAN cert names each host. One matches a single label and hides your hostnames, the other publishes them and limits the damage. Default to named certs, and here is why.

On August 14, 2026, an invalid TLS certificate blocked access to Claude's own status page. If a company valued near a trillion dollars can miss a certificate, so can you. Here is how it happens, why it happens in public, and how to catch it first.

A dedicated sending IP sounds like the professional upgrade. For most senders it is a self-inflicted deliverability wound. Here is when each model is the right call, and the records you own the moment you switch.

A certificate chain that works in your browser can fail for API and mobile clients. Here is why chains break, why the failure hides, and how to verify one from outside.

A CAA record names which CAs may issue certificates for your domain. One DNS line closes off a whole class of mis-issuance. Here is how to use it.