Question 1

What's the difference between TLS 1.2 and TLS 1.3?

Accepted Answer

TLS 1.3 (2018): Faster handshake (1-RTT vs 2-RTT), forward secrecy by default, removed weak algorithms. TLS 1.2: still widely supported, more config options. Action: always require TLS 1.2+ minimum. TLS 1.3 preferred for new deployments. Disable TLS 1.0/1.1 entirely, they're cryptographically broken.

Question 2

When should I use mTLS instead of OAuth 2.0?

Accepted Answer

mTLS (mutual TLS): service-to-service auth, certificate-based, no human interaction, works offline. OAuth: user delegation, human login, revocation via token endpoints. Use mTLS for internal APIs, service mesh (Istio), database connections. Use OAuth for user-facing APIs. Can combine both: OAuth for authentication, mTLS for service-to-service transport.

Question 3

How do I automate certificate renewal?

Accepted Answer

Use ACME protocol with certbot (free Let's Encrypt) or cloud-native tools (AWS ACM, Cloudflare). For Let's Encrypt: `certbot renew --quiet` in a daily cron job. For production: use ACME clients in your orchestration (cert-manager in Kubernetes). Certs expire in 90 days by default, automate renewal before expiry (runs at day 60+).

Question 4

What are mixed content errors and how do I fix them?

Accepted Answer

Mixed content: HTTPS page loading HTTP resources (images, scripts, stylesheets). Browsers block active (scripts/frames) and warn on passive (images). Fix: update all asset URLs to HTTPS, use protocol-relative URLs (`//cdn.example.com/asset.js`), or upgrade your CDN. Check browser console for mixed-content warnings.

Question 5

What is HSTS and should I enable it?

Accepted Answer

HSTS (HTTP Strict-Transport-Security) header tells browsers to ONLY use HTTPS for your domain (bypasses HTTP). `Strict-Transport-Security: max-age=31536000; includeSubDomains`. Start with short max-age (300s), test thoroughly, then increase. Preloading requires domain to be in browser HSTS preload list (see hstspreload.org). Risk: if cert expires or you misconfigure, domain is unreachable until max-age expires.

Question 6

How do I validate my TLS config?

Accepted Answer

Use Qualys SSL Labs (https://www.ssllabs.com/ssltest/) for comprehensive scan: grade A+/A/B/C, cipher strength, protocol version, certificate validity, vulnerabilities. Command-line: `openssl s_client -connect example.com:443 -tls1_3` to verify protocol. Check certificate with: `openssl x509 -in cert.pem -text -noout`.

Question 7

Can I use self-signed certificates in production?

Accepted Answer

Not recommended without additional setup. Self-signed certs bypass browser trust chain, users see security warnings. Exception: internal APIs (service-to-service) can use self-signed + custom CA bundle. For public HTTPS: use Let's Encrypt (free, fully automated). For internal mTLS: generate self-signed CA, issue certs to services, distribute CA cert to clients.

प्रदेश	ज्युनियर	मध्यम	सीनियर
USA	$90k	$130k	$170k
UK	£55k	£80k	£110k
EU	€60k	€85k	€120k
CANADA	C$95k	C$135k	C$175k

SSL/TLS

SSL/TLS म्हणजे काय

📋 सुरू करण्यापूर्वी

💰 प्रदेशानुसार पगार

🎓 प्रमाणपत्रे

🎯 SSL/TLS वापरणारी करिअर

⚖ यांच्याशी तुलना करा

❓ FAQ

हे कौशल्य तुमच्यासाठी योग्य आहे का, याची खात्री नाही?

तुमचा आदर्श करिअर मार्ग शोधा