Merge pull request #33 from josephstreeter/docs/certbot

Docs/certbot

Author: josephstreeter

docs/_posts/2012-11-27-DMVPN-Lab.md

@@ -4,6 +4,8 @@ date:   2012-11-27 00:00:00 -0500
 categories: IT
 ---
 
+> **⚠️ Historical lab (2012) — not current crypto guidance.** This walkthrough uses cryptography that is no longer acceptable: RSA-1536 keys, SHA-1 hashing, MD5 certificate fingerprints, and Diffie-Hellman group 5. Do **not** copy these values into production. Use RSA ≥ 2048 (or ECDSA), SHA-256+, and modern DH/ECDH groups. See [Certificate Management](../security/certificates/index.md) for current standards.
+
 Some time ago I had to teach myself DMVPN so that I could troubleshoot and manager the current system. If I remember right, I got a lot of the information and text from somewhere. I'm just not sure where I got it from and what I wrote myself.
 
 ***Preparation***
@@ -40,6 +42,7 @@ speed auto
 
 ***R3******
 ***interface FastEthernet1/0
+
 ```console
 ip address 10.10.0.3 255.255.255.0
 duplex auto
@@ -239,7 +242,7 @@ network 192.168.251.1 0.0.0.0
 no auto-summary
 ```
 
-Configure Branch routers to use R1 as the primary DMVPN hub by adding ***delay 100 ***to the ***tunnel1*** interfaces
+Configure Branch routers to use R1 as the primary DMVPN hub by adding ***delay 100*** to the ***tunnel1*** interfaces
 
 ***R3
 ***interface Tunnel1

docs/_posts/2013-08-13-Disable-SSLv2-on-Windows-Server-2008-Domain-Controllers.md

@@ -4,7 +4,9 @@ date:   2013-08-13 00:00:00 -0500
 categories: IT
 ---
 
-Using LDAP over SSL is a good step towards security. Improve security just a little bit more by disabling SSLv2 and forcing your clients to use SSLv3
+> **⚠️ Historical post — do not follow as written.** This 2013 article predates the POODLE attack (2014) and targets Windows Server 2008 (end-of-life). **SSLv3 is now insecure and must also be disabled**, along with TLS 1.0 and TLS 1.1. Configure clients and servers for **TLS 1.2 (minimum) and TLS 1.3**. See the current guidance in [SSL vs TLS](../security/certificates/sslvstls.md) and [Certificate Management](../security/certificates/index.md).
+
+Using LDAP over SSL is a good step towards security. The original advice below disabled SSLv2 and fell back to SSLv3 — that is no longer safe. Disable **SSLv2, SSLv3, TLS 1.0, and TLS 1.1**, and require **TLS 1.2 or higher** on all domain controllers.
 
 On each of your domain controllers create the following registry key:
 

docs/_posts/2013-09-24-Create-and-Install-a-Self-Signed-SSL-Certificate-on-Apache-CentOS-6.md

@@ -4,7 +4,9 @@ date:   2013-09-24 00:00:00 -0500
 categories: IT
 ---
 
-SSL is a great way to protect traffic to your website. These are the steps to create a self-signed certificate and install it on an apache web server. It is self-signed, so the user's browser will throw an error because it doesn't trust the certificate. It's a start though....
+> **⚠️ Historical post (2013) — outdated.** CentOS 6 is end-of-life, and its OpenSSL defaulted to SHA-1 signatures. The command below also sets only a Common Name (no SAN), which modern browsers reject. **For a public website, use a free, automatically renewed certificate from a trusted CA** — see the [ACME / Certbot guide](../security/certificates/acme/certbot.md). Reserve self-signed certificates for development or internal use, and always include Subject Alternative Names — see [Self-Signed Certificates](../security/certificates/self-signed.md).
+
+SSL is a great way to protect traffic to your website. These are the steps to create a self-signed certificate and install it on an apache web server. It is self-signed, so the user's browser will throw an error because it doesn't trust the certificate. It's a start for development and internal use only.
 
 Install Mod SSL
 
@@ -54,5 +56,3 @@ Restart Apache
 ```powershell
 service httpd restart
 ```
-
-

docs/development/das/setup/azure-app-service.md

@@ -40,7 +40,7 @@ Resource Naming Pattern: {project}-{environment}-{service}-{region}
 **Environment Strategy:**
 
 | Environment | Purpose | Configuration | Scaling |
-|-------------|---------|---------------|---------|
+| ----------- | ------- | ------------- | ------- |
 | **Development** | Testing and staging | Basic tier, manual scaling | 1 instance |
 | **Production** | Live documentation | Standard/Premium tier, auto-scaling | 2-10 instances |
 | **Preview** | Pull request previews | Shared with development | On-demand |

docs/infrastructure/containers/authentik/index.md

@@ -35,7 +35,7 @@ author: "Joseph Streeter"
 #### Core Identity Services
 
 | Feature | Description | Enterprise Benefit |
-|---------|-------------|-------------------|
+| ------- | ----------- | ------------------ |
 | **Single Sign-On (SSO)** | Unified authentication across applications | Improved user experience and security |
 | **Multi-Factor Authentication** | TOTP, WebAuthn, SMS, Email | Enhanced security posture |
 | **Protocol Support** | SAML 2.0, OAuth2, OIDC, LDAP | Universal application compatibility |
@@ -137,7 +137,7 @@ graph TB
 #### Component Details
 
 | Component | Purpose | Scaling Considerations |
-|-----------|---------|----------------------|
+| --------- | ------- | ---------------------- |
 | **Authentik Server** | Main application logic and API | Stateless - horizontal scaling |
 | **Worker** | Background tasks and jobs | Multiple workers for performance |
 | **Outpost** | Proxy and LDAP services | Deploy near applications |
@@ -273,7 +273,7 @@ services:
 #### System Requirements
 
 | Component | Minimum | Recommended | Production |
-|-----------|---------|-------------|------------|
+| --------- | ------- | ----------- | ---------- |
 | **CPU** | 2 cores | 4 cores | 8+ cores |
 | **Memory** | 4GB RAM | 8GB RAM | 16+ GB RAM |
 | **Storage** | 20GB | 100GB | 500+ GB SSD |
@@ -899,7 +899,7 @@ Authentik uses a flexible flow system that allows you to customize the authentic
 #### Core Flow Types
 
 | Flow Type | Purpose | Use Cases |
-|-----------|---------|-----------|
+| --------- | ------- | --------- |
 | **Authentication** | User login process | SSO, multi-step authentication |
 | **Authorization** | Access control decisions | Policy enforcement, consent |
 | **Invalidation** | Session termination | Logout, account suspension |

docs/infrastructure/containers/kubernetes/certmanage.md

@@ -141,7 +141,7 @@ spec:
 
 ### Creating Self-Signed Certificates
 
-For development or internal services:
+For development or internal services only. For the full self-signed and OpenSSL reference (formats, key types, validation), see [Self-Signed Certificates](../../../security/certificates/self-signed.md) and the [OpenSSL Guide](../../../security/certificates/openssl/index.md). In production, prefer cert-manager with an ACME or CA issuer (below).
 
 ```bash
 # Generate private key
@@ -151,8 +151,9 @@ openssl genrsa -out tls.key 2048
 openssl req -new -key tls.key -out tls.csr \
   -subj "/C=US/ST=State/L=City/O=Organization/CN=app.example.local"
 
-# Generate self-signed certificate
-openssl x509 -req -in tls.csr -signkey tls.key -out tls.crt -days 365
+# Generate self-signed certificate — include a SAN (modern clients ignore the CN)
+openssl x509 -req -in tls.csr -signkey tls.key -out tls.crt -days 365 \
+  -extfile <(printf "subjectAltName=DNS:app.example.local")
 
 # Create Kubernetes secret
 kubectl create secret tls app-tls-secret \

docs/infrastructure/containers/kubernetes/ingress.md

@@ -28,7 +28,7 @@ Key components:
 Comparison with other service exposure methods:
 
 | Method | Use Case | Pros | Cons |
-|--------|----------|------|------|
+| ------ | -------- | ---- | ---- |
 | NodePort | Development/Testing | Simple setup | Limited port range |
 | LoadBalancer | Cloud environments | Cloud integration | Cost per service |
 | Ingress | Production HTTP/HTTPS | Advanced routing, SSL | Requires controller |

docs/infrastructure/monitoring/grafana/security.md

@@ -15,6 +15,9 @@ This guide covers implementing production-grade security for your Grafana and Pr
 
 ### Generate Self-Signed Certificates (Development)
 
+> [!NOTE]
+> The certificate-generation steps below are a convenience for development/mTLS setup. For the authoritative guide to OpenSSL, self-signed certificates, key types, and formats, see [Self-Signed Certificates](../../../security/certificates/self-signed.md) and the [OpenSSL Guide](../../../security/certificates/openssl/index.md). Use publicly trusted or internal-CA certificates (not self-signed) for production monitoring endpoints.
+
 ```bash
 #!/bin/bash
 # generate-certs.sh

docs/infrastructure/networking/unifi/802.1x.md

@@ -20,7 +20,7 @@ This comprehensive guide covers implementing 802.1x authentication on UniFi Drea
 ### Key Benefits
 
 | Benefit | Description | Use Cases |
-|---------|-------------|-----------|
+| ------- | ----------- | --------- |
 | **Network Segmentation** | Automatic VLAN assignment based on authentication | Guest networks, IoT devices, employee access |
 | **Enhanced Security** | Prevents unauthorized network access | Corporate environments, secure facilities |
 | **Centralized Management** | Single point of authentication control | Large deployments, compliance requirements |
@@ -412,7 +412,7 @@ Dynamic_VLAN_Configuration:
    - Generate intermediate CA for device certificates
    - Configure certificate templates for devices and users
 
-2. **Device Certificate Generation**
+2. **Device Certificate Generation** (for the full OpenSSL/CSR reference, see [Certificate Management](../../../security/certificates/index.md) and the [OpenSSL Guide](../../../security/certificates/openssl/index.md))
    ```bash
    # OpenSSL example for device certificate
    # Generate private key