How to Check Which Certificate a Server Is Actually Serving
What your config file says and what the server actually presents can differ — verify directly.
Task-focused guides covering the full lifecycle of certificate management, across every major server platform and format.
What your config file says and what the server actually presents can differ — verify directly.
Terminate once, at the edge, and let backend servers stay simpler.
A short, current configuration block rather than a hand-assembled cipher list.
Same goal as the Nginx version, different directive names.
Free tools that watch expiry for you, so renewal is never a surprise.
One Certbot invocation, or a loop, rather than renewing domain by domain.
Caddy does this almost entirely automatically — worth knowing before manually configuring Nginx.
There's no recovery — reissuance is the only path forward.
AutoSSL and similar tools that issue certificates for every domain automatically, without a manual list.
Not an in-place change — it's a new certificate with a different validation process behind it.
CloudFront has one hard requirement everyone trips over at least once: the certificate has to live in us-east-1, no matter where your actual content is.
Most Elastic Beanstalk environments run behind a load balancer already — the certificate goes there, not on your application code.
ATS blocks weak or missing TLS by default in every iOS app — here's how exceptions actually work, and why to scope them as narrowly as possible.
DSM can issue and auto-renew a Let's Encrypt certificate for you, or you can import your own — both live in the same Control Panel screen.
Omnibus GitLab can request and renew Let's Encrypt certificates itself, or you can point it at your own — the setting lives in one file either way.
A built-in ACME add-on or a reverse proxy in front are the two realistic paths — which one fits depends on how you're already running it.
Plex issues and rotates a certificate for you automatically for most setups — a manual certificate is only needed if you want your own domain in the URL.
Getting this wrong can lock you out of your own firewall's web interface — keep console access handy before you start.