# TLS (Transport Layer Security) TLS (Transport Layer Security) is an Internet security protocol that enables client/server applications to communicate while protecting against eavesdropping, tampering, and message forgery. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## JDK 27 Security Enhancements DevFeed: [JDK 27 Security Enhancements]() Original publisher: [Read original article]() Author: Sean Mullan Published: 2026-09-16T00:00:00Z Content type: article Language: en Sources: [Inside Java]() Topics: [JDK 27](), [Security](), [Cryptography](), [Encryption](), [TLS (Transport Layer Security)](), [Post-Quantum](), [Release notes]() Tags: [certificates](), [cryptographic](), [encryption](), [jdk-27](), [notes](), [password](), [post-quantum](), [private-key](), [release-notes](), [security](), [tls]() ### AI overview This article reviews selected security enhancements in JDK 27, released on September 15, 2026. It highlights TLS 1.3 support for post-quantum hybrid key exchange mechanisms and the third preview of the PEM API for encoding and decoding cryptographic objects. ### Source excerpt JDK 27 was released on September 15, 2026! As with my previous blogs, I have compiled a list of what I think are the most interesting and useful security enhancements in this release. I have also grouped them into appropriate categories (crypto, TLS, etc) which should make it easier to find out what has changed in each specific area. The JDK 27 release notes also contain further details on these and other enhancements. ## Java 27 Reaches GA With The G1 Garbage Collector By Default Everywhere DevFeed: [Java 27 Reaches GA With The G1 Garbage Collector By Default Everywhere]() Original publisher: [Read original article]() Author: Michael Larabel Published: 2026-09-15T13:39:00Z Content type: news Language: en Sources: [Phoronix]() Topics: [Java](), [openjdk](), [releases](), [Concurrency](), [Post-Quantum](), [TLS (Transport Layer Security)]() Tags: [availability](), [concurrency](), [desktop-linux](), [java](), [linux-benchmarking](), [linux-hardware-benchmarks](), [linux-hardware-reviews](), [linux-how-to](), [linux-performance](), [linux-server-benchmarks](), [open-source-graphics](), [openjdk](), [phoronix](), [phoronix-test-suite](), [post-quantum](), [release](), [structured-concurrency](), [tls](), [ubuntu-benchmarks](), [ubuntu-hardware]() ### AI overview OpenJDK 27 has reached general availability. Its G1 garbage collector is now enabled by default across environments, replacing Serial as the default in constrained environments after improvements in throughput, latency, and memory usage. The release also includes post-quantum hybrid key exchange for TLS 1.3, preview features for lazy constants and structured concurrency, compact object headers by default, and an incubating Vector API. ### Source excerpt Oracle christened Java 27 today with the OpenJDK 27 release reaching general availability (GA) status... ## Running a Self-Hosted Tailscale Control Server Behind a Reverse Proxy DevFeed: [Running a Self-Hosted Tailscale Control Server Behind a Reverse Proxy]() Original publisher: [Read original article]() Author: Philipp Lehmann (philipp.lehmann@gruppe.ai) Published: 2026-09-15T07:00:00Z Content type: tutorial Language: en Sources: [Philipp Lehmann]() Topics: [tailscale](), [proxy](), [traefik](), [TLS (Transport Layer Security)](), [TLS handshake](), [Self-hosted](), [Homelab]() Tags: [dns](), [docker](), [h2](), [homelab](), [networking](), [proxy](), [reverse-proxy](), [security](), [self-hosted](), [tailscale](), [tls](), [tls-handshake](), [traefik]() ### AI overview This tutorial explains how to run a self-hosted Tailscale control server, Headscale, behind Traefik. It finds that the reverse proxy must use TLS with HTTP/1.1 only because Tailscale's noise handshake expects a full-duplex byte stream and can fail when ALPN negotiates HTTP/2. ### Source excerpt Headscale behind Traefik: tls.options=no-h2@file with alpnProtocols http/1.1, because the Tailscale noise handshake breaks when ALPN negotiates h2. ## Rustls 0.23.45 Released To Fix Two Year Old Security Issue DevFeed: [Rustls 0.23.45 Released To Fix Two Year Old Security Issue]() Original publisher: [Read original article]() Author: Michael Larabel Published: 2026-09-14T15:35:11Z Content type: news Language: en Sources: [Phoronix]() Topics: [TLS (Transport Layer Security)](), [Security](), [vulnerability](), [Rust](), [Memory Safety](), [Go Language]() Tags: [bugs](), [desktop-linux](), [go](), [library](), [linux-benchmarking](), [linux-hardware-benchmarks](), [linux-hardware-reviews](), [linux-how-to](), [linux-performance](), [linux-server-benchmarks](), [open-source-graphics](), [phoronix](), [phoronix-test-suite](), [rust](), [rustls](), [security](), [tls](), [ubuntu-benchmarks](), [ubuntu-hardware](), [vulnerability]() ### AI overview Rustls 0.23.45 fixes a vulnerability in which TLS 1.3 handshake messages sent at the wrong encryption level could be accepted as plaintext after a key-changing message. The issue was present since Rustls 0.23.13 and could allow an on-path attacker to inject plaintext messages, although the authenticated handshake transcript prevented altering or completing the handshake. ### Source excerpt While the Rustls modern TLS library is written in the Rust programming language with a focus on memory safety, as we've seen out of other Rust project re-implementations in the past, the new implementations can lead to other security bugs of their own. Out today is Rustls 0.23.45 to fix a security issue introduced back in 2024 with Rustls while the likes of OpenSSL, BoringSSL, and others are unaffected... ## Enabling TLS in PXC without Downtime DevFeed: [Enabling TLS in PXC without Downtime]() Original publisher: [Read original article]() Author: Juan Arruti Published: 2026-09-09T23:32:15Z Content type: tutorial Language: en Sources: [Blog - Percona]() Topics: [TLS (Transport Layer Security)](), [Replication](), [Security](), [Network](), [openssl]() Tags: [galera](), [high-availability](), [insight-for-dbas](), [mysql](), [open-source](), [percona](), [pxc](), [replication](), [security](), [ssl](), [tls](), [tls-handshake](), [uncategorized](), [xtradb-cluster-pxc]() ### AI overview This tutorial explains how to enable TLS for replication traffic in Percona XtraDB Cluster without a full cluster restart. Using Galera's socket.dynamic option, operators can perform two rolling restarts: first allowing encrypted and plaintext connections, then enforcing TLS-only communication. ### Source excerpt Starting with Percona XtraDB Cluster (PXC) 8.0, replication traffic encryption is enabled by default. That said, it's common to find clusters running without TLS that suddenly need it: a new compliance requirement, an audit finding, a network segment that is no longer considered trusted. PXC has a variable for exactly that case, pxc-encrypt-cluster-traffic, which handles ... Continued The post Enabling TLS in PXC without Downtime appeared first on Percona. ## Announcing Appwrite Domains: your registrar and DNS host DevFeed: [Announcing Appwrite Domains: your registrar and DNS host]() Original publisher: [Read original article]() Author: Aditya Oberai Published: 2026-09-04T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [TLS (Transport Layer Security)](), [Cloud]() Tags: [api](), [cloud](), [dns](), [domain](), [organization](), [products](), [tls]() ### AI overview Appwrite announces Appwrite Domains, a feature of Appwrite Cloud that combines domain registration, authoritative DNS hosting, TLS management, and hostname connections for Sites, Functions, and project APIs within an organization. ### Source excerpt Appwrite Domains brings registration, DNS, and TLS into your organization. Buy names across 160+ TLDs, host the zone, and connect Sites and Functions. ## curl 8.22.0 DevFeed: [curl 8.22.0]() Original publisher: [Read original article]() Author: Daniel Stenberg Published: 2026-09-02T05:52:46Z Content type: release Language: en Sources: [Daniel Stenberg]() Topics: [cURL](), [Security](), [HTTP](), [openssl](), [API](), [TLS (Transport Layer Security)](), [Command-line interface]() Tags: [bugfixes](), [command-line](), [curl](), [curl-and-libcurl](), [cve](), [cves](), [http](), [openssl](), [release](), [security](), [tls]() ### AI overview The curl 8.22.0 release includes six changes, 302 bug fixes, and nine curl/libcurl security fixes plus one wcurl fix. It adds Apple GSS Framework support, API guards, experimental HTTP Message Signatures support, and Apple fast UDP, while blocking NTLM fallback in SPNEGO and dropping TLS-SRP support. ### Source excerpt Welcome to this new release. Get it as always from https://curl.se. If you rather want a security-patched older release branch, stay tuned for the follow-up Rock-solid curl announcement within a few days. Release presentation Numbers the 276th release6 changes70 days (total: 10,887)302 bugfixes (total: 14,489)525 commits (total: 39,608)0 new public libcurl function (total: 100)4 new ... Continue reading curl 8.22.0 -> ## Announcing native MySQL databases: Bring your MySQL workloads to Appwrite DevFeed: [Announcing native MySQL databases: Bring your MySQL workloads to Appwrite]() Original publisher: [Read original article]() Author: Jake Barnby Published: 2026-09-02T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [MySQL](), [Databases](), [Provisioning](), [Availability](), [Replication](), [autoscaling](), [TLS (Transport Layer Security)]() Tags: [announcements](), [autoscaling](), [availability](), [database](), [databases](), [mysql](), [provisioning](), [replication](), [tls]() ### AI overview Appwrite announces native managed MySQL databases that can run inside the same project as an application's existing backend. The service supports MySQL 8.4 and 8.0, standard drivers and ORMs, TLS, backups and point-in-time recovery, replicas with automatic failover, database branches, scaling, and connection pooling. ### Source excerpt Provision a managed MySQL 8.4 instance inside your Appwrite project and keep using the drivers, ORMs, and tools your applications already depend on. ## Sites using PQC (September 2026) DevFeed: [Sites using PQC (September 2026)]() Original publisher: [Read original article]() Published: 2026-09-01T14:49:46Z Content type: article Language: en Sources: [Signs of Triviality]() Topics: [Post-quantum cryptography](), [Post-Quantum](), [TLS (Transport Layer Security)](), [Cryptography]() Tags: [2026](), [cryptography](), [post](), [post-quantum](), [post-quantum-cryptography](), [quantum](), [september-2026](), [sites](), [tls](), [top](), [using]() ### AI overview A periodic check examines which of the top 1 million domains support post-quantum cryptography in their TLS key exchange. ### Source excerpt One more periodic check of which of the top 1M domains support post-quantum cryptography in their TLS key exchange. ## Rotating Expiring X.509 Certificates in Percona Server for MongoDB with Minimal Service Interruption DevFeed: [Rotating Expiring X.509 Certificates in Percona Server for MongoDB with Minimal Service Interruption]() Original publisher: [Read original article]() Author: Ivan Groenewold Published: 2026-08-31T11:48:11Z Content type: tutorial Language: en Sources: [Blog - Percona]() Topics: [MongoDB](), [TLS (Transport Layer Security)](), [Authentication](), [configuration]() Tags: [authentication](), [certificates](), [insight-for-dbas](), [mongodb](), [private-key](), [rotation](), [security](), [tls](), [x509]() ### AI overview This tutorial explains how to renew same-CA X.509 certificates in Percona Server for MongoDB with minimal service interruption. It covers reloading TLS material with rotateCertificates, certificate and private-key configuration, limitations, validation, and cases where hot reload should not be used. ### Source excerpt Expired TLS certificates can prevent new client connections and, when X.509 is used for Percona Server for MongoDB internal authentication, also prevent members of a replica set or sharded cluster from authenticating to one another. In this post we will discuss performing a same-CA renewal: replacement certificates for server, member, and client leaf are issued ... Continued The post Rotating Expiring X.509 Certificates in Percona Server for MongoDB with Minimal Service Interruption appeared first on Percona. ## Kubernetes v1.37: Pod Certificates and Cluster Trust Bundles DevFeed: [Kubernetes v1.37: Pod Certificates and Cluster Trust Bundles]() Original publisher: [Read original article]() Author: Taahir Ahmed Published: 2026-08-28T18:30:00Z Content type: article Language: en Sources: [Kubernetes Blog]() Topics: [Kubernetes](), [Authentication](), [JSON Web Tokens](), [TLS (Transport Layer Security)](), [Cloud]() Tags: [authentication](), [blog](), [cloud](), [cryptographic](), [json](), [kubernetes](), [post](), [tls](), [tokens]() ### AI overview Kubernetes 1.37 introduces generally available Pod Certificates and Cluster Trust Bundles, adding built-in X.509 certificate issuance for TLS and mTLS. The article explains how this production identity mechanism relates to existing service account JWTs and addresses the security limitations of bearer tokens. ### Source excerpt Pod Certificate / Cluster Trust Bundles Blog Post Kubernetes brings a wealth of features that make it easy to run your production workloads securely and reliably. While aspects like scheduling, health checks and resource limits are probably at the front of your mind, one other important feature of Kubernetes is production identity -- how your workload can authenticate to other systems in order to do its job. Up until now, the primary production identity mechanism built into Kubernetes has been service account JWTs (JSON Web Tokens). These are cryptographically-signed tokens, issued by the control plane of your cluster, that let anyone in the world understand who is calling when your workload uses them. In Kubernetes 1.37, the foundations of a new built-in production identity technology have gone GA. Pod Certificates (and the closely-associated Cluster Trust Bundles) build X.509 certificate issuance for TLS and mTLS directly into core Kubernetes. Why? Service account JWTs have a lot going for them: They are built directly into Kubelet, and work pretty magically. They are written to your workload container's filesystem before your workload starts up, and automatically kept up to date. The issuance system follows least-privilege principles; the node restriction admission plugin ensures that tokens can only be requested by the Kubelet that is actually currently running your pod. They can be federated, allowing you to use them to authenticate to other systems outside of Kubernetes. Service account JWTs underpin the pod-to-cloud authentication store for all of the largest cloud providers, and have widespread support across many additional services and software packages. If it can understand JWTs, you can authenticate to it with a service account token. However, service account JWTs have one big downside -- they are bearer tokens. With bearer tokens, if you have the token, then you are the identity asserted by the token. And since you necessarily have to hand copies of the J ## 【kube-apiserver】Mutating / Validating Webhook：timeout、failurePolicy 与可用性门 DevFeed: [【kube-apiserver】Mutating / Validating Webhook：timeout、failurePolicy 与可用性门]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-28T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Kubernetes](), [configuration](), [dry-run](), [TLS (Transport Layer Security)](), [API]() Tags: [admission](), [api](), [apiserver](), [cel](), [configuration](), [distributed](), [kubernetes](), [kyverno](), [mutating](), [timeout](), [tls](), [v1-30-3](), [validating](), [webhook]() ### AI overview A tutorial on configuring and troubleshooting Kubernetes v1.30.3 mutating and validating admission webhooks. It explains configuration fields, timeout and failurePolicy behavior, production availability requirements, reinvocation and idempotency, CEL ValidatingAdmissionPolicy boundaries, and an evidence-based troubleshooting approach. It emphasizes that slow webhooks add latency to the admission path rather than indicating etcd lag. ### Source excerpt 钉 K8s v1.30.3 的 MutatingWebhookConfiguration / ValidatingWebhookConfiguration v1：timeoutSeconds、failurePolicy、sideEffects、reinvocationPolicy 字段语义；webhook 慢如何表现为写路径延迟而非 etcd lag；生产可用性门选取；CEL ValidatingAdmissionPolicy 作为内置替代路径；排障证据包。 ## Quality Outreach Heads-up - JDK 28: Named Group Information Captured in the TLSHandshake JFR Event DevFeed: [Quality Outreach Heads-up - JDK 28: Named Group Information Captured in the TLSHandshake JFR Event]() Original publisher: [Read original article]() Author: Ana-Maria Mihalceanu Published: 2026-08-21T00:00:00Z Content type: release Language: en Sources: [Inside Java]() Topics: [JDK 28](), [Flight](), [TLS (Transport Layer Security)](), [Security](), [openjdk]() Tags: [jdk-28](), [jdk-flight-recorder](), [openjdk](), [release](), [security](), [tls](), [tls-handshake](), [update]() ### AI overview The OpenJDK Quality Group announces that, starting with JDK 28, the jdk.TLSHandshake JFR event records the named group negotiated between the client and server during key exchange. The event is disabled by default and requires explicit enablement. ### Source excerpt This Heads-Up is part of the regular communication sent to the projects involved; it covers that the named group information is included in the jdk.TLSHandshake JFR event. ## Deep dive into Amazon EKS certificate authority rotation DevFeed: [Deep dive into Amazon EKS certificate authority rotation]() Original publisher: [Read original article]() Author: Micah Hausler Published: 2026-08-19T20:55:49Z Content type: article Language: en Sources: [Containers]() Topics: [Amazon EKS](), [TLS (Transport Layer Security)](), [Availability](), [AWS Fargate](), [CI/CD](), [Security]() Tags: [advanced-300](), [amazon-eks](), [amazon-elastic-kubernetes-service](), [announcements](), [availability](), [aws](), [aws-fargate](), [ci-cd](), [deep-dive](), [security](), [technical-how-to](), [tls]() ### AI overview This deep dive explains Amazon EKS certificate authority rotation. It describes the managed lifecycle, automated safeguards, rollback, AWS-managed components, and the customer responsibilities needed to preserve connectivity during the transition. ### Source excerpt Amazon EKS now provides a managed, non-disruptive lifecycle for rotating your cluster's certificate authority (CA), with automated safeguards and rollback. This deep dive explains how CA rotation works, what AWS handles versus what you must update, and how to walk through the rotation lifecycle on your own timeline. ## Test Days for Fedora 45: Help Us Test the Big Changes DevFeed: [Test Days for Fedora 45: Help Us Test the Big Changes]() Original publisher: [Read original article]() Author: Petr Sklenar Published: 2026-08-14T17:22:24Z Content type: article Language: en Sources: [Fedora Magazine]() Topics: [Fedora](), [boot](), [ci](), [virtualization](), [Internationalization (i18n)](), [Confidential Computing](), [dnf](), [TLS (Transport Layer Security)](), [Matrix]() Tags: [article](), [community](), [developers](), [dnf](), [events](), [fedora-project-community](), [graphics](), [kernel](), [new-in-fedora](), [python](), [qa](), [test-day](), [testing](), [tls](), [virtualization]() ### AI overview This article invites the Fedora community to test Fedora 45 system-level changes on real hardware and virtual machines. It highlights testing for GNOME 51, RPM 6.1, OpenSSL 4.0, rebuilt boot and live media, kmscon, Python 3.15, GRUB EFI for Confidential Computing, and internationalization changes. Community testing is intended to find regressions that automated tests may miss and to support reproducible bug reports. ### Source excerpt Fedora 45 has several system-level changes that need testing on real hardware. The first test day up is GNOME 51, starting on 17 August, with more events planned for RPM 6.1, installation media and others. You can participate with a VM for most tests; some hardware-specific testing is more useful on a real machine. Details [...] ## Using observability to verify TLS certificate rotation in production DevFeed: [Using observability to verify TLS certificate rotation in production]() Original publisher: [Read original article]() Author: Sridhar Rajarao Published: 2026-08-13T00:00:00Z Content type: article Language: en Sources: [Sridhar Rajarao]() Topics: [TLS (Transport Layer Security)](), [observability](), [TLS handshake](), [Automation](), [nginx](), [Kubernetes]() Tags: [automation](), [nginx](), [observability](), [reliability](), [sre](), [tls](), [tls-handshake]() ### AI overview The article explains that automating certificate renewal does not prove that production endpoints serve the new certificate. It recommends externally probing customer-facing endpoints and measuring certificate details and real TLS handshakes across proxies, regions, ingress controllers, CDNs, gateways, and other endpoints. ### Source excerpt Automation renews a certificate. Observability proves every endpoint is serving it and customers can complete a TLS handshake. ## Multi-Region PostgreSQL Disaster Recovery and Failback with Crunchy PGO DevFeed: [Multi-Region PostgreSQL Disaster Recovery and Failback with Crunchy PGO]() Original publisher: [Read original article]() Author: Wellingtone Luvonga Published: 2026-08-11T05:00:00Z Content type: tutorial Language: en Sources: [CYBERTEC PostgreSQL | Services & Support]() Topics: [PostgreSQL](), [Disaster Recovery](), [Kubernetes](), [MinIO](), [nginx](), [TLS (Transport Layer Security)](), [Amazon S3](), [Availability]() Tags: [availability](), [backup](), [data-recovery](), [disaster-recovery](), [failover](), [high-availability](), [how-to](), [kubernetes](), [minio](), [nginx](), [postgresql](), [recovery](), [s3](), [tls](), [tutorials]() ### AI overview A tutorial on using Crunchy PostgreSQL Operator on Kubernetes to implement multi-region PostgreSQL disaster recovery and failback. It covers secure MinIO-backed WAL storage through an NGINX TLS reverse proxy, regional failover, and reversing roles without timeline conflicts or archive poisoning. ### Source excerpt This blog talks about multiregion PostgreSQL disaster recovery using Crunchy PGO. It has some detailed steps to understand better. The post Multi-Region PostgreSQL Disaster Recovery and Failback with Crunchy PGO appeared first on CYBERTEC PostgreSQL | Services & Support. ## Caddy: proxy inverso con HTTPS automático DevFeed: [Caddy: proxy inverso con HTTPS automático]() Original publisher: [Read original article]() Author: Antonio Pérez Published: 2026-08-06T00:00:00Z Content type: tutorial Language: es Sources: [tengoping.com]() Topics: [proxy](), [TLS (Transport Layer Security)](), [let's encrypt](), [nginx](), [traefik](), [Go]() Tags: [debian](), [fedora](), [go](), [let-s-encrypt](), [nginx](), [proxy](), [rhel](), [systemd](), [tls](), [traefik](), [ubuntu]() ### AI overview This Spanish tutorial explains how Caddy works as a Go-based reverse proxy with automatic HTTPS certificate issuance and renewal through Let's Encrypt or ZeroSSL. It compares Caddy with Nginx and Traefik, then covers installation and basic Caddyfile configuration. ### Source excerpt Caddy emite y renueva certificados HTTPS automáticamente vía Let's Encrypt sin tocar Certbot: Caddyfile, requisitos y comparativa con Nginx y Traefik. ## v20.2.3 Tentacle released DevFeed: [v20.2.3 Tentacle released]() Original publisher: [Read original article]() Author: Yuri Weinstein Published: 2026-08-05T00:00:00Z Content type: release Language: en Sources: [Ceph Blog]() Topics: [Deployment](), [Server](), [Hardware](), [TLS (Transport Layer Security)](), [Kafka](), [Grafana Cloud Metrics](), [Monitoring](), [Command-line interface](), [IO]() Tags: [2026](), [authentication](), [blog-post](), [cli](), [en-article](), [en-blog-post](), [hardware](), [io](), [kafka](), [metrics](), [monitoring](), [release](), [storage](), [tentacle](), [tls]() ### AI overview Ceph v20.2.3, the third minor release in the Tentacle series, is a recommended update containing fixes and improvements across metadata servers, object storage daemons, RADOS Gateway, client libraries, the dashboard, ceph-volume, and NVMe-oF. Changes include storage reliability fixes, TLS 1.3 cipher customization, encrypted object copying, Kafka notification authentication, hardware monitoring, CSV host uploads, and role-management updates. ### Source excerpt This is the third minor release in the Tentacle series. We recommend that all users update to this release. Release Date ¶ August 5, 2026 Notable Changes ¶ MDS (Metadata Server) ¶ Fixed a crash and shutdown hang that could occur when ephemeral pins were active and max_mds was set to 0. Session reclaim could miss blocklisting an old session; this is now handled correctly. Fixed a case where scrub was unable to identify damage from an irreparable hard link. OSD (Object Storage Daemon) ¶ BlueStore: Fixed a BlueFS WAL envelope-mode bug that caused write buffer misalignment. Erasure Coding: Fixed truncate+write planning for EC shard sizes. Fixed a condition that prevented rolling forward of PG log entries. Prevented OSDMap::check_health() from asserting when new OSDs are found in a subtree. Scrub: "repairing" scrubs -- deep scrubs re-run specifically to fix a previously detected inconsistency -- are no longer blocked by the configured allowed scrub hours/days; they can now run at any time. RGW (RADOS Gateway) ¶ Added the ssl_ciphersuites option for the Beast front-end to support TLS 1.3 cipher customization. Fixed PutObject's canned_acl comparison bug affecting BlockPublicAcls. Fixed crashes occurring on realm reload. Implemented CopyObject support for encrypted objects. Added mTLS client-certificate authentication support for Kafka notifications. Fixed removal of delete markers in lifecycle processing. RADOS / librados / neorados ¶ neorados: Fixed an infinite trim loop on empty data log shards. Fixed cancellation-slot cleanup in librados/asio's associated executor. Dashboard ¶ Added a hardware-monitoring dashboard backed by node-proxy metrics. Fixed a bind-address regression caused by CherryPy isolation. Added support for adding hosts via CSV upload. NVMeoF: multiple CLI and UI backports (EC pool support, IO statistics, role management). Object: The global RGW Roles tab has been removed. Role management is now scoped under RGW Accounts, where roles can be listed, created, ## Vaultwarden: gestor de contraseñas autoalojado DevFeed: [Vaultwarden: gestor de contraseñas autoalojado]() Original publisher: [Read original article]() Author: Antonio Pérez Published: 2026-08-03T00:00:00Z Content type: tutorial Language: es Sources: [tengoping.com]() Topics: [Docker](), [Docker Compose](), [TLS (Transport Layer Security)](), [nginx](), [proxy](), [backups]() Tags: [backups](), [bitwarden](), [compose](), [docker](), [docker-compose](), [hardening](), [homelab](), [https](), [nginx](), [proxy](), [tls](), [vaultwarden]() ### AI overview A Spanish-language tutorial explains how to self-host Vaultwarden, an unofficial Rust server compatible with Bitwarden clients. It covers Docker Compose deployment, HTTPS behind an Nginx reverse proxy, admin-token hardening, and backups, while noting the trade-off between community support and the official Bitwarden server. ### Source excerpt Instala Vaultwarden con Docker: servidor ligero compatible con los clientes de Bitwarden, con HTTPS, hardening del admin token y backups. ## Traefik: proxy inverso para contenedores DevFeed: [Traefik: proxy inverso para contenedores]() Original publisher: [Read original article]() Author: Antonio Pérez Published: 2026-08-03T00:00:00Z Content type: tutorial Language: es Sources: [tengoping.com]() Topics: [traefik](), [Docker](), [proxy](), [let's encrypt](), [Docker Compose](), [TLS (Transport Layer Security)]() Tags: [docker](), [docker-compose](), [let-s-encrypt](), [proxy](), [tls](), [traefik]() ### AI overview This tutorial explains how Traefik acts as a reverse proxy for Docker containers. It covers automatic container discovery through Docker labels, routing with entryPoints, routers, and services, and automatic HTTPS certificates through Let's Encrypt. It also compares Traefik with manually configured Nginx and mentions Caddy as an alternative. ### Source excerpt Traefik detecta tus contenedores Docker automáticamente y les da HTTPS con Let's Encrypt vía labels, sin tocar un fichero de configuración. ## How Yandex is building a cloud platform for smart-home devices without a hub DevFeed: [How Yandex is building a cloud platform for smart-home devices without a hub]() Original publisher: [Read original article]() Author: IvanovVadimVladimirovich (Яндекс) Published: 2026-07-28T08:00:37Z Content type: article Language: ru Sources: [Яндекс - Как мы делаем Яндекс / Статьи]() Topics: [Internet of things](), [cpu](), [TLS (Transport Layer Security)]() Tags: [cloud](), [cpu](), [embeded](), [iot](), [smartdevices](), [tag-4d6d71beb3c0](), [tag-cf299fffcf93](), [tls]() ### AI overview This developer article describes Yandex's new smart-home device platform, designed to operate without a mandatory hub and support more than one million active devices. It covers BLE-based commissioning, a single cloud connection, a single-threaded execution model, and reconnection handling for unreliable home networks. ### Source excerpt Убрать обязательный хаб из умного дома -- звучит как продуктовое решение. На практике в этой формулировке спрятано много неприятной инженерии. Устройство должно само войти в экосистему, само держать долгоживущее облачное соединение, само обновляться -- в общем, всё делать без посредника. И это на железе с ограниченной памятью и слабым CPU, в домашней сети, которая в любой момент может пропасть. На таком масштабе каждый лишний TLS-коннект, каждая дополнительная аллокация, каждый хрупкий ретрай начинает стоить по-настоящему дорого. Мощным бэкендом здесь не поможешь: ограничение -- на клиентской стороне. Поэтому мы шли в обратную сторону: последовательно убирали лишнюю сложность на каждом слое -- от заводского контура до транспортного канала. Мы строим новую платформу для устройств умного дома Яндекса, которая должна держать больше миллиона активных устройств. В этой статье -- про конкретные решения: комиссионинг без хаба, один канал вместо зоопарка соединений, однопоточную модель исполнения и дисциплину переподключений на плохой сети. Читать далее ## Certificados SSL gratis con Certbot DevFeed: [Certificados SSL gratis con Certbot]() Original publisher: [Read original article]() Author: Antonio Pérez Published: 2026-07-27T00:00:00Z Content type: tutorial Language: es Sources: [tengoping.com]() Topics: [let's encrypt](), [SSL](), [TLS (Transport Layer Security)]() Tags: [https](), [let-s-encrypt](), [ssl](), [tls]() ### AI overview A tutorial explaining how Certbot and Let's Encrypt use ACME validation, when to choose HTTP-01 or DNS-01, how wildcard certificates work, and the implications for automatic renewal. ### Source excerpt Cómo funciona la validación ACME, cuándo usar HTTP-01 o DNS-01, cómo emitir certificados wildcard y cómo funciona la renovación automática de Certbot. ## RFC 9880 and the IoT Validation Problem DevFeed: [RFC 9880 and the IoT Validation Problem]() Original publisher: [Read original article]() Author: Stefano Fago Published: 2026-07-26T00:00:00Z Content type: article Language: en Sources: [Nicolas Fränkel]() Topics: [Internet of things](), [SDF](), [data](), [JSON](), [Code](), [CoAP](), [MQTT](), [HTTP](), [TLS (Transport Layer Security)]() Tags: [architecture](), [code](), [data](), [development](), [iot](), [json](), [protocol](), [sdf](), [standards](), [validation]() ### AI overview This article examines RFC 9880 and its Semantic Definition Format (SDF) as an ecosystem-neutral, JSON-based way to describe IoT devices. It argues that SDF validation is best understood as a compilation problem and discusses how different IoT ecosystems represent the same physical concepts incompatibly. ### Source excerpt The IoT/IIoT world has a data model problem and the concept of Digital Twin has made this issue more important. Plenty of people have tried to fix it. RFC 9880 and its Semantic Definition Format (SDF) are a serious attempt: a JSON-based, ecosystem-neutral way to describe what a device is and what it does. I have had some experiences with this specification, and I've understood that the format shows its full value once you treat it as source code, something you compile. [Next page]()