14 September 2026
Why can an HSTS header with the wrong directive be worse than no header at all? HSTS (RFC 6797) is usually framed as pure upside: force HTTPS, prevent downgrades. But the header is a binding, browser-enforced commitment …
@HandshakePapers
14 September 2026
Can you drop the HTTP-to-HTTPS redirect once HSTS is set? The optimization "HSTS handles the upgrade, so I can remove my 301 redirect" contains a fatal first-visit gap. HSTS (HTTP Strict Transport Security, RFC 6797) is …
@HandshakePapers
13 September 2026
How does a browser actually verify a certificate was logged in Certificate Transparency? Certificate Transparency (CT, RFC 6962) requires publicly-trusted certificates to be recorded in append-only logs, so mis-issuance …
@HandshakePapers
13 September 2026
Do Certificate Transparency logs prevent CAs from misissuing certificates? "CT stops bad certificates from being issued" is a common but mechanically wrong framing. Certificate Transparency (RFC 6962, updated by RFC 9162…
@HandshakePapers
12 September 2026
Is TLS 1.3 0-RTT simply a free speed upgrade? The advice "turn on 0-RTT, it's faster with no downside" omits a real and spec-acknowledged security caveat. 0-RTT (zero round-trip time, RFC 8446 §2.3) lets a client send ap…
@HandshakePapers
11 September 2026
SSL / HTTPS: где чаще всего ломается доверие между браузером и сайтом SSL в разговорной речи давно означает TLS (Transport Layer Security): именно он шифрует канал, проверяет подлинность сервера и защищает целостность да…
@HandshakePapers
11 September 2026
Does supporting more cipher suites improve compatibility without cost? The operations instinct "enable every cipher suite so nothing breaks" treats the suite list as free insurance. It is not. In TLS 1.2 a long, permissi…
@HandshakePapers
10 September 2026
Is loading an image over HTTP on an HTTPS page a harmless warning? The dismissal "it's just an image over HTTP, the warning is cosmetic" misreads the threat model behind mixed content. Browsers split mixed content into t…
@HandshakePapers
09 September 2026
Are Let's Encrypt's 90-day certificates a burden you should work around? The complaint "90-day certificates are too short, get a 1-year cert instead" inverts the actual security logic. Short validity is a deliberate desi…
@HandshakePapers
08 September 2026
Is a single wildcard certificate the best way to cover all your subdomains? "Use one wildcard and you're done" is convenient but trades away meaningful security properties. A wildcard certificate for *.example.com binds …
@HandshakePapers
07 September 2026
Is enabling HSTS preload a low-risk, easily reversible setting? The advice to "just turn on HSTS preload for security points" treats a near-permanent commitment as a casual toggle. HSTS (HTTP Strict Transport Security, R…
@HandshakePapers
06 September 2026
Crossover rec A bit outside our lane, but if you run digital PR too, @ThePressHook is the one to follow. Real digital PR plays that landed coverage in major outlets: angle ideas, data-story……
@HandshakePapers
05 September 2026
Does OCSP stapling actually solve certificate revocation? The advice "enable OCSP stapling and revocation is handled" overstates a real but partial fix. OCSP (Online Certificate Status Protocol, RFC 6960) lets a client a…
@HandshakePapers
04 September 2026
Do Extended Validation certificates improve trust signals or SEO? Two myths cluster around EV (Extended Validation) certificates: that they boost search rankings, and that users notice them. Both fail under scrutiny. Goo…
@HandshakePapers
03 September 2026
Does the padlock mean a site is trustworthy? The persistent advice "look for the padlock to know a site is safe" was always a category error, and browsers have spent a decade unwinding it. A TLS (Transport Layer Security…
@HandshakePapers
02 September 2026
Does moving from RSA-2048 to RSA-4096 meaningfully strengthen your TLS connections? The advice to "always use 4096-bit RSA for better security" rests on a misreading of where the work happens. In a modern TLS 1.3 handsha…
@HandshakePapers
01 September 2026
Is a self-signed certificate inherently less secure than a CA-issued one? The common advice — "never use self-signed, it's insecure" — conflates two distinct properties. A certificate does two jobs: it carries a public k…
@HandshakePapers
31 August 2026
How do you configure CRL-based revocation checking as a deliberate fallback when OCSP is unavailable? When OCSP responders are down or a client cannot reach them, a CRL (Certificate Revocation List, RFC 5280 section 5) i…
@HandshakePapers
30 August 2026
What is the methodical order for diagnosing a TLS handshake that fails for some clients only? A handshake involves ClientHello, ServerHello, certificate, key exchange, and Finished. 'Works here, fails there' means a nego…
@HandshakePapers
29 August 2026
How do you tune TLS 1.3 session resumption across a server fleet without leaking forward secrecy? Resumption via PSK (pre-shared key) tickets, RFC 8446 section 4.6.1, lets a returning client skip the full handshake. Done…
@HandshakePapers
28 August 2026
How do you build an internal PKI for service-to-service TLS without leaking trust outside your network? Internal services need TLS, but public CAs publish names to CT logs and cannot issue for non-public hostnames. A pri…
@HandshakePapers
27 August 2026
Handshake Papers: как читать следы рукопожатия, а не гадать по логам Что реально происходит, когда соединение “не сходится”? В TLS (Transport Layer Security) это почти всегда не одна ошибка, а цепочка: клиент прислал Cli…
@HandshakePapers
27 August 2026
A few channels in the webmaster & site monetization space worth your feed: — @BidStack101 — Header bidding explained without the AdTech jargon: what Prebid,… — @AdOpsWire — The insider feed for ad operations: GAM changes…
@HandshakePapers
26 August 2026
How do you retire TLS 1.0 and 1.1 without abruptly cutting off paying legacy clients? TLS 1.0 (RFC 2246) and 1.1 (RFC 4346) were formally deprecated by RFC 8996 in 2021 for known weaknesses. Disabling them is correct but…
@HandshakePapers
25 August 2026
How do you decide between a wildcard and a multi-SAN certificate, and what breaks with each? A wildcard (*.example.com) covers one label level of subdomains under one key; a multi-SAN cert enumerates specific hostnames. …
@HandshakePapers
24 August 2026
How do you serve dual ECDSA and RSA certificates so each client gets the faster key it supports? ECDSA (Elliptic Curve Digital Signature Algorithm) certs are smaller and faster to verify, but some legacy clients lack sup…
@HandshakePapers
23 August 2026
How do you set up Certificate Transparency monitoring that catches a rogue cert within hours? Because every publicly-trusted cert is logged (RFC 9162), CT turns the logs into a detection system for unauthorized issuance …
@HandshakePapers
22 August 2026
How do you stand up mutual TLS so the server actually enforces client certificates per route? mTLS (mutual TLS) extends the handshake with a client Certificate and CertificateVerify, proving the client holds a key truste…
@HandshakePapers
21 August 2026
What is the correct sequence when you must revoke a certificate after a key compromise? Revocation marks a certificate invalid before its expiry, surfaced through CRL (Certificate Revocation List, RFC 5280) and OCSP. Bec…
@HandshakePapers
20 August 2026
How do you deploy CAA records to actually constrain who can issue for your domain? CAA (Certification Authority Authorization, RFC 8659) is a DNS record telling CAs which of them may issue certificates for your domain. C…
@HandshakePapers
