Server update

Another year, another dive into what’s changed in running a web server. This VM is now basically up-to-date, and supports most of the shiny new web transport improvements, like HTTP/2 and OCSP stapling. Hopefully nothing broke too badly in the process.

Lets Encrypt

I’ve begun to transition this site to use Lets Encrypt! for signing of SSL. Because the site has specified an HPKP previously, a transition period is needed where clients can see the old certification signing the intention to transition to the new certification.

That process has started, and the full transition will happen in a couple months. The good news is that the letsencrypt setup process was otherwise painless.


I’ve updated this domain to include the new HPKP mechanism and a stronger intermediate cert. HPKP supplements the previous HSTS mechanism to define a specific signing key that must be present on subsequent HTTPS interactions with the server, helping to mitigate one class of man in the middle attacks.