Infraintermediate

SSL/TLS Certificate Management

Provision, configure, and renew SSL/TLS certificates to encrypt traffic between clients and servers.

Also known as: SSL certificates, TLS certificates, HTTPS certificates, X.509 certificates, certificate management

Description

SSL/TLS certificate management encompasses the lifecycle of X.509 certificates used to establish encrypted HTTPS connections between clients and servers. This includes provisioning certificates from a Certificate Authority (CA), configuring them on web servers or load balancers, monitoring expiration dates, and automating renewal. Proper TLS configuration is essential for data privacy, integrity, and authentication, and is a baseline requirement for any production web application.

Certificate types range from Domain Validated (DV) certificates, which verify domain ownership, to Organization Validated (OV) and Extended Validation (EV) certificates, which additionally verify organizational identity. Wildcard certificates (*.example.com) cover all subdomains at one level, while Subject Alternative Name (SAN) certificates can cover multiple specific domains. Modern best practice favors short-lived certificates (90 days via Let's Encrypt) with automated renewal over long-lived certificates that risk being forgotten.

TLS configuration involves selecting appropriate protocol versions (TLS 1.2 minimum, TLS 1.3 preferred), cipher suites (AEAD ciphers like AES-256-GCM and ChaCha20-Poly1305), enabling HSTS headers with includeSubDomains and preload directives, configuring OCSP stapling for revocation checking, and implementing Certificate Transparency monitoring. Certificate pinning is generally discouraged for web applications due to operational risk, but remains relevant for mobile app backends.

Prompt Snippet

Configure TLS termination at the reverse proxy layer with TLS 1.2 as the minimum version and TLS 1.3 preferred. Use Mozilla's 'Intermediate' cipher suite configuration. Enable HSTS with max-age=31536000, includeSubDomains, and preload. Configure OCSP stapling with a resolver directive pointing to the DNS provider. Set up Certificate Transparency log monitoring via a cron job or service like certspotter. Redirect all HTTP traffic to HTTPS with a 301 permanent redirect at the server block level.