Yannick Lyn Fatt writes that new updates to the `serversideup/php` Docker images allow FrankenPHP containers to serve real HTTPS via Let's Encrypt using only an IP address. By utilizing the `shortlived` ACME profile, users can obtain valid certificates without requiring a DNS entry, which is particularly beneficial for self-hosting, staging environments, or internal APIs reachable by IP.
- Requires pinning the Docker image to v4.6.0-beta1 or later.
- The short-lived certificate profile issues credentials valid for 160 hours.
- Configuration requires setting a `default_sni` via `CADDY_GLOBAL_OPTIONS` because IP connections lack SNI metadata.
- Certificates and ACME state must be persisted in `/config` and `/data` volumes to avoid Let's Encrypt rate limits during redeploys.
- Requires pinning the Docker image to v4.6.0-beta1 or later.
- The short-lived certificate profile issues credentials valid for 160 hours.
- Configuration requires setting a `default_sni` via `CADDY_GLOBAL_OPTIONS` because IP connections lack SNI metadata.
- Certificates and ACME state must be persisted in `/config` and `/data` volumes to avoid Let's Encrypt rate limits during redeploys.
Google is implementing Merkle Tree Certificates to mitigate the size increase of quantum-resistant cryptographic data for HTTPS certificates, ensuring compatibility and preventing slowdowns. This approach verifies large amounts of information with a small fraction of the data, maintaining the current 64-byte certificate length.
A detailed exploration of how clients and servers negotiate and bootstrap connections using HTTP/1.1, HTTP/2, and HTTP/3, covering redirects, TLS, ALPN, Alt-Svc, HSTS, and DNS records. It also discusses the complexities of upgrading to HTTP/3 and the behavior of different browsers.
The SVCB and HTTPS resource records allow you to speed up your time-to-first-packet (by basically stuffing the Alt-Svc HTTP header / ALPN TLS extension into the DNS); let you do redirection on the zone apex without using CNAMEs; allow for simple DNS load distribution and failover; obviate HSTS and the cumbersome preloading process; and enable stronger privacy protections via Encrypted Client Hello aka ECH
$ dumpcap -w some.pcapng -f "host example.com"
$ SSLKEYLOGFILE=some.keys curl https://example.com
$ editcap --inject-secrets tls,some.keys some.pcapng some-with-keys.pcapng
Now you can load some-with-keys.pcapng in Wireshark 3.0 or newer without
requiring any further configuration and have its
$ SSLKEYLOGFILE=some.keys curl https://example.com
$ editcap --inject-secrets tls,some.keys some.pcapng some-with-keys.pcapng
Now you can load some-with-keys.pcapng in Wireshark 3.0 or newer without
requiring any further configuration and have its
