Luca BertonEnabling HTTPS is table stakes. Configuring it correctly is where most organizations fail. Weak cipher suites, legacy protocol support, missing security headers — each is a vulnerability that automated scanners and regulators will find.
Protocol Configuration
- TLS 1.3 only — Where possible, disable TLS 1.2. TLS 1.3 eliminates weak cipher suites by design, reduces handshake latency, and removes legacy attack surfaces (BEAST, POODLE, Lucky13)
- TLS 1.2 minimum — If legacy clients require TLS 1.2, disable all CBC-mode ciphers and prioritize AEAD cipher suites (AES-GCM, ChaCha20-Poly1305)
- Disable SSLv3, TLS 1.0, TLS 1.1 — No exceptions. These are broken protocols. PCI DSS has required this since 2018
Cipher Suite Selection
For TLS 1.3 (all are strong by default):
- TLS_AES_256_GCM_SHA384
- TLS_CHACHA20_POLY1305_SHA256
- TLS_AES_128_GCM_SHA256
For TLS 1.2 (if required):
- ECDHE-ECDSA-AES256-GCM-SHA384
- ECDHE-RSA-AES256-GCM-SHA384
- ECDHE-ECDSA-CHACHA20-POLY1305
- Disable RSA key exchange (no forward secrecy), RC4, 3DES, and all export ciphers
Kubernetes Recipes
A practical guide for container orchestration and deployment by Grzegorz Stencel & Luca Berton (Apress).
Watch on Skillshare →Security Headers
- HSTS —
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload - HSTS preloading — Submit to the HSTS preload list for browser-enforced HTTPS
- CAA records — DNS CAA records limiting which CAs can issue certificates for your domain
- OCSP Stapling — Enable OCSP stapling to improve certificate validation performance and privacy
Certificate Configuration
- RSA 4096-bit or ECDSA P-384 keys (ECDSA preferred — faster and stronger)
- Short-lived certificates (90 days or less) with automated renewal
- No wildcard certificates on public-facing services (limits blast radius)
- Separate certificates per service (not shared across unrelated domains)
Root Cause Analysis: Principles and Benefits
Master root cause analysis techniques for systematic problem solving. In collaboration with Starweaver.
Start on Coursera →Automated Compliance Scanning
Run automated TLS configuration scanning continuously: SSL Labs API, testssl.sh in CI/CD, custom checks against your security policy. Flag and remediate misconfigurations before they become audit findings.