TLS

Lock down PostgreSQL 17 on Debian 13: listen addresses, scram-sha-256, a minimal pg_hba.conf, TLS with certbot, least-privilege roles and a tested restore.

How a DNS hijack lets attackers pass ACME validation and get rogue TLS certificates, and how to limit it with CAA accounturi, CT diffs and DNSSEC.

Fix curl (60) unable to get local issuer certificate on Debian 13: find out if the server chain, client trust store, clock or a proxy is at fault.

OpenSSL DSA-6531-1 fixes 13 CVEs on Debian 13. Check libssl3t64 against 3.5.7-1~deb13u3, restart daemons using the old library and verify the fix.

Automate Let's Encrypt on Debian 13 with certbot: timer, nginx deploy hook, OnFailure alerts, expiry checks and prep for 64- and 45-day certificates.

Web server security baseline for Debian 13: unattended-upgrades, key-only SSH, certbot TLS with HSTS, nftables and Fail2ban, with checks for each step.