A confident deployment guide for TLS and PKI

Our journey to better network transport security has been quite the ride, filled with ups and downs. Back in the ’90s, when SSL and the Netscape browser were just taking off, things were pretty hard. We were dealing with weak encryption, export restrictions on cryptography, and computers that couldn’t keep up. But over the years, we’ve made some serious strides.

We’ve had our fair share of setbacks. The Web kept evolving, often without much thought to security, which didn’t make our job any easier. But we didn’t give up. We kept at it, figuring out what works and what doesn’t. And slowly but surely, we started to see tangible improvements.

A Confident Deployment Guide for TLS and PKI

With this guide, A Confident Deployment Guide for TLS and PKI, we’re handing you the keys to the castle. We’ve distilled years of experience and hard-earned knowledge into a practical roadmap for deploying TLS and PKI. No jargon, no fluff—just straightforward advice to get you where you need to go.

We dive deep into essential aspects of network security, covering everything from private keys and certifications to configuration, HTTP and application security, performance optimization, and validation and monitoring. 

This guide will help you understand the complexities surrounding private keys and certificates, ensuring you understand their critical role in establishing secure connections. You’ll learn best practices for configuring TLS and PKI to maximize security while minimizing complexity. 

Protecting HTTPS like it was meant to be protected

We also explore techniques for enhancing website and application security to protect against common TLS and PKI configuration problems. With discussion around strategies for optimizing performance without compromising security, striking the delicate balance between speed and safety. The guide covers effective methods for validating configurations and monitoring network traffic to detect and mitigate potential threats in real-time, providing a comprehensive understanding of network security fundamentals and practical insights to fortify your digital infrastructure effectively.

From SSL Labs to Hardenize, we’ve been in the trenches, helping websites improve their security. And while my book, Bulletproof TLS and PKI – which helps to understand and deploy SSL/TLS and PKI to secure servers and web applications is a treasure trove of information for the hardcore security buffs, this guide is for everyone else. Whether you’re a seasoned Sysadmin or a newbie developer, we’re here to help.

So buckle up and get ready to ride the waves of network security. With a little bit of know-how and a whole lot of determination. Here’s to smoother sailing ahead!

Download your copy here.

Still want to know more?

Misconfigurations in the expanding attack surface are silent threats that can escalate into significant security risks. Often overlooked or undiscovered, these weak points can jeopardize your posture, compliance, financial footing, and reputation. 

Discover how Red Sift ASM illuminates these hidden dangers by watching our webinar which will give you the knowledge and tools to harden your organization’s digital landscape.

Uncover the hidden dangers of asset misconfigurations


Ivan Ristic

28 Feb. 2024



Recent Posts


Introducing DNS Guardian: Stop impersonation and spam caused by domain takeovers 

Rahul Powar

tl;dr: We’re thrilled to announce DNS Guardian — a new feature in Red Sift OnDMARC that can swiftly identify and stop domain takeovers that lead to malicious mail. Back in February, we shared updates with the community about SubdoMailing – an attack discovered by Guardio Labs. The attack was a form of subdomain takeover,…

Read more

Navigating the Information Security Landscape: ISO 27001 vs. SOC 2

Red Sift

As cyber threats evolve, so do the standards and frameworks designed to combat them. Two of the most recognized standards in information security are ISO 27001 and SOC 2. What sets them apart, and which one is right for your organization? Let’s delve into the key differences. Purpose and Scope: Global Framework vs. Client-Centric…

Read more

G2 Summer 2024 Report: Red Sift OnDMARC’s Winning Streak Continues

Francesca Rünger-Field

We’re delighted to announce that Red Sift OnDMARC has again been named a Leader in G2’s DMARC category for Summer 2024. This recognition is based on our high Customer Satisfaction scores and strong market presence. Red Sift appeared in 11 reports – 5 new ones since Spring 2024! – earning 5 badges: A few…

Read more

Google will no longer trust Entrust certificates from October 2024

Red Sift

Tl;dr: Google has announced that as of October 31, 2024, Chrome will no longer trust certificates signed by Entrust root certificates. While there is no immediate impact on existing certificates or those issued before 31st October 2024, organizations should start reviewing their estate now. On Thursday 27th June 2024, Google announced that it had…

Read more

Understanding the polyfill.io domain attack

Francesca Rünger-Field

tl;dr: The recent compromise of the polyfill.io domain has triggered a broad-reaching web supply chain attack, impacting over 100,000 websites across various sectors including finance, healthcare, non-profits, academia, and more. To ensure the security of your website, we strongly advise you immediately remove any reference to polyfill.io. Latest update: 27th June 2024 Sansec, a…

Read more