HTTPS is the foundation. Ale je your TLS configuration opravdu withoutpečná?
Certificate¶
- ☐ Platný certifikát (ne self-signed v produkci)
- ☐ Automatic renewal (Let’s Encrypt + certbot)
- ☐ Certificate chain kompletní
- ☐ Wildcard nebo SAN pro subdomény
Thereforecols¶
- ☐ TLS 1.2 minimum
- ☐ TLS 1.3 preferovaný
- ☐ SSL 2.0/3.0 a TLS 1.0/1.1 VYPNUTÉ
- ☐ Silné cipher suites
- ☐ Forward secrecy (ECDHE)
Headers¶
- ☐ HSTS (Strict-Transport-Security)
- ☐ HTTP → HTTPS redirect
- ☐ HSTS preload (volitelné)
- ☐ Expect-CT (deprecated, ale stále užitečné)
Testing¶
- ☐ SSL Labs test (A+ rating)
- ☐ Certificate expiry monitoring
- ☐ Mixed content check
- ☐ OCSP stapling funguje
Automation¶
Let’s Encrypt + certbot –renew = no expirované certifikáty.
ssltlssecurity