It Works in My Browser: Debugging TLS Certificate Errors in Chains, SANs and Expiry

Your browser shows a padlock and your partner's API client throws "unable to get local issuer certificate". Both are correct. A practical guide to the four things a TLS client actually checks, and to renewal automation that reaches the running server instead of just the disk.

Continue ReadingIt Works in My Browser: Debugging TLS Certificate Errors in Chains, SANs and Expiry

Your Deploy Key Is a Root Shell: GitHub Actions VPS Deployment Over SSH, Done Carefully

A deploy key in GitHub secrets is a shell on your production server, handed to a container you don't control, running code from maintainers you've never met. Here's how to build the pipeline so a leaked key isn't worth much: forced commands, scoped sudo, pinned actions and a real approval gate.

Continue ReadingYour Deploy Key Is a Root Shell: GitHub Actions VPS Deployment Over SSH, Done Carefully