Part 5 of the security fundamentals series. Encoding, encryption, hashing, MACs and digital signatures compared by purpose and reversibility, symmetric versus asymmetric keys, and how TLS combines them all in one connection.
We moved a dozen small services from Nginx to Caddy and kept Nginx in front of two others. This is the honest comparison: automatic HTTPS, config side by side, what performance looked like, and the migration traps around headers, body limits and certificate storage.
Most HTTP bugs can be pinned down with one tool you already have. This guide shows the curl options we use daily: verbose output, header-only requests, --resolve and --connect-to for testing servers before DNS changes, timing breakdowns, protocol versions and TLS checks.
A new subdomain's certificate sat in pending for hours with a self check error: wrong status code 404, expected 200. The challenge solver created its Ingress with an ingress class our controller ignored. Setting the class on the solver and checking the redirect path fixed issuance.
Our customer portal went dark at 07:12 when its Let's Encrypt certificate expired. Certbot's timer had run twice a day for a month and failed every time, because a firewall change blocked port 80. Here is how we traced it, fixed it and made expiry impossible to miss.
Our API certificate renewal looked perfect in desktop Chrome, yet the Android app, curl and a partner's Java service all rejected it. The server sent only the leaf certificate without the intermediate. Serving the full chain fixed every client at once.