The apex CNAME problem is solved. Most browsers never got the memo.
RFC 9460 fixed apex aliasing in the protocol, but the clients never followed. In multi-provider DNS, where vendor workarounds are off the table, that leaves you with no fallback.
The Blog
Things I had to figure out the hard way — DNS, TLS, CDN internals, and the edge cases nobody warns you about.
-
-
Zero-downtime deploys without a platform: the symlink pattern
rsync to a versioned directory, atomically swap a symlink, keep the last five releases. That is the entire pattern. Here is how to do the swap without surprises — and what the filesystem cannot cover for you.
-
Three walls between you and post-quantum TLS on stock Ubuntu nginx
Enabling X25519MLKEM768 on Ubuntu 24.04 with oqs-provider sounds like a one-line change. It is not. A field report on the three non-obvious blockers.
-
· securityTrust on a Timer: Why 47-Day Certificates Break Static Pinning
By 2029, public TLS certificates will live just 47 days. The math alone retires a decade of mobile-app security practice — and forces every architect to revisit how trust is established, rotated, and revoked.