This series treats security settings as contracts with scope and failure modes. It covers transport, headers, certificate renewal, host keys, cookies, HSTS, and certificate-authority authorization records.
Use SNI, inspect the public certificate, and alert before renewal becomes an incident.
HSTS is cached browser policy, so a configuration mistake can outlive the server change that created it.
Start with a narrow policy, then expand it only when a documented feature needs another resource.
Record the expected fingerprint, use a deliberate StrictHostKeyChecking policy, and treat changes as an incident until explained.
A cookie sent to more hosts or paths than necessary enlarges the impact of every mistake at those boundaries.
CAA narrows certificate issuance policy, but a mistaken record can block renewal as effectively as an expired certificate.
Read the chain the edge actually presents, not just the leaf, before you trust the rollout.
Read every trust signal at the edge, from the CSP header to the certificate chain and the authorized issuer.