TLS in practice
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
configure TLS correctly everywhere data crosses a network.
Planned topics
- TLS gives encryption, server identity, and optionally client identity (mutual TLS, mTLS).
- Certificates are issued by a CA and expire; automate renewal (for example cert-manager or a cloud service).
- Encrypt service-to-service traffic and database connections too, with verification of the server certificate (
sslmode=verify-fullfor PostgreSQL). - Never disable certificate validation to "make it work"; fix the trust store instead.
- Use current TLS versions; verify the recommended minimum before recording.
Draft outline details
Demonstration
JDBC URL jdbc:postgresql://db:5432/shop?sslmode=verify-full&sslrootcert=/certs/ca.pem.
Check your understanding
What is wrong with a client that trusts every certificate?
Show answer
Anyone can impersonate the server.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.