tls

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyInsecureTransport",
      "Effect": "Deny",

package deps

import (
  "crypto/tls"
  "crypto/x509"
  "net/http"

server {
  listen 443 ssl;
  server_name internal-api.example.com;

  ssl_certificate /etc/nginx/tls/server.crt;
  ssl_certificate_key /etc/nginx/tls/server.key;

# Install cert-manager (Helm)
# helm install cert-manager jetstack/cert-manager #   --namespace cert-manager #   --create-namespace #   --set installCRDs=true

---
# ClusterIssuer for Let's Encrypt (staging)
apiVersion: cert-manager.io/v1

import requests

response = requests.get('https://crt.sh/', params={'q': '%.example.com', 'output': 'json'}, timeout=15)
response.raise_for_status()
certs = response.json()
print(certs[:5])

#!/usr/bin/env bash
set -euo pipefail

certbot renew --quiet --deploy-hook "systemctl reload nginx"
openssl x509 -enddate -noout -in /etc/letsencrypt/live/example.com/fullchain.pem

final class PinnedSessionDelegate: NSObject, URLSessionDelegate {
    func urlSession(_ session: URLSession, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
        guard let serverTrust = challenge.protectionSpace.serverTrust else {
            completionHandler(.cancelAuthenticationChallenge, nil)
            return
        }