Let's Encrypt

Russian Websites Remain Dependent on Foreign SSL Certificates and Analytics Despite Sanctions

A Russian security researcher developed an open-source tool to scan websites for dependencies on foreign services that could be cut off abruptly. The scan of 50 major Russian sites including banks, retailers, telecoms, airlines, delivery services, online schools and government portals revealed that servers have largely been migrated domestically. However, critical components such as SSL certificates, analytics platforms and fonts remain tied to overseas providers. 43 out of 50 sites still use foreign SSL certificates, primarily from Belgian GlobalSign and American Let's Encrypt, while only four rely on the Russian NUC certificate from the Ministry of Digital Development. The study also highlights legal obligations under Roskomnadzor rules effective since March 2023 requiring prior notification for cross-border personal data transfers. Many sites continue using Google Analytics, Google Fonts and reCAPTCHA without realizing the compliance and resilience risks. The tool assigns letter grades from A to F based on the number of foreign dependencies detected.

Deploying Self-Hosted Hysteria 2 Proxy on Debian-Based Linux VPS via Terminal

A detailed guide explains how to set up a personal Hysteria 2 proxy server on a KVM VPS running Debian or Ubuntu without any web panels. The process begins with generating ed25519 SSH keys, hardening the sshd_config file, and restricting access with ufw to only TCP port 22 and UDP port 443. Hysteria 2 is downloaded from GitHub, made executable, and configured using a TOML file that enables salamander obfuscation and a self-signed TLS certificate. A custom systemd unit ensures the service restarts on failure. The client configuration includes SHA256 pinning of the server certificate to prevent MITM attacks. The guide emphasizes manual CLI operations that apply equally to other services such as Nginx and stresses checking local laws before deployment.

Secure Custom Domain Setup for Client Status Pages Using CNAME, Certbot and Go Instead of ACME On-Demand

A detailed case study describes how a monitoring service implemented white-label status pages on customer domains without relying on ACME on-demand certificate issuance. The approach uses pre-validated domains stored in a database, background DNS checks via CNAME or A-record matching, and a root helper script running on a systemd timer to handle certbot issuance and nginx configuration. Key design choices separate privileges so the Go application never touches certificates or nginx directly, while loopback endpoints are protected against proxy header spoofing. The solution explicitly addresses risks such as DoS through malicious Host headers exhausting Let's Encrypt rate limits, private key exposure, and first-visitor latency during TLS handshakes. Hysteresis in DNS status prevents temporary resolution glitches from disabling active customer pages. The entire implementation stays under a few hundred lines of code and runs reliably on a single server with nginx in front of the Go application.

TSPU Filtering Disrupts Timeweb Cloud Servers: Diagnosis, CDN Failures, and Reverse Proxy Bypass

Russian hosting provider Timeweb Cloud experienced widespread TSPU-based DPI filtering starting in early June that selectively blocked TLS handshakes on port 443 while leaving SSH, ICMP, and TCP connectivity intact. The issue affected multiple providers including Beget and Selectel, was publicly acknowledged by Timeweb on June 5, and proved highly variable by region, operator, and time of day. Attempts to mitigate via new IP addresses or Timeweb's own CDN failed due to poisoned caches and platform outages, while Yandex Cloud CDN blocked all POST requests required for WordPress functionality. A working solution involved deploying a minimal nginx reverse proxy on another Russian cloud VPS that preserves full HTTP methods, handles certificate synchronization, and routes ACME challenges correctly. Timeweb support later closed tickets without resolution after requesting ineffective mtr traces that cannot detect DPI behavior. The case highlights systemic challenges in diagnosing state-mandated filtering and the limitations of standard network diagnostics against selective TLS interference.

Building Trusted TLS in Kubernetes Without InsecureSkipVerify Using cert-manager and trust-manager

The article explains how to establish verifiable TLS across a Kubernetes cluster running on Talos with Cilium networking and Linstor storage, eliminating reliance on InsecureSkipVerify flags. It details the creation of an internal self-signed CA via cert-manager, using a selfSigned bootstrap issuer to generate the CA certificate before deploying a production ClusterIssuer. trust-manager then distributes only the public CA bundle as ConfigMaps across all namespaces, allowing workloads to validate certificates without exposing private keys. For external services, an ACME issuer integrates with Let's Encrypt and Gateway API to automate HTTP-01 challenges. The guide also covers kubelet server certificate rotation through serverTLSBootstrap and the kubelet-serving-cert-approver controller, which validates CSR requests against Node objects before approval. These steps ensure mutual trust for internal services, publicly trusted certificates for internet-facing endpoints, and verified kubelet connections for the API server and monitoring systems.