ssl

This post originated on a question from a colleague about how to make your services restart automatically upon automated certificate rotation and replacement.

Implementing TLSA or HPKP for certificate pinning while using automated certificate authorities such as Let’s Encrypt can be tricky. These notes explain how I do it on my servers, using GnuTLS to do the heavylifting.