Reverse proxies and TLS: a short checklist

Every time I put a service behind a reverse proxy I go through the same short list, because the failures are always boring ones.

Certificates. Let the proxy obtain and renew them itself, and check that the renewal path (usually port 80 or a DNS API token) is actually reachable. A certificate that renews in theory is not a certificate that renews.

Protocol versions. TLS 1.2 and 1.3 only. Turn on HTTP/2; leave HTTP/3 to whoever needs it.

Headers. Add HSTS once you are sure every subdomain serves HTTPS, and remove the Server header so the proxy does not advertise its version.

Upstreams. Bind the application to 127.0.0.1 so the only way in is through the proxy, and make sure the firewall agrees with that.

Verify from outside. Run curl against the public name from another network, not from the box itself. Half of my past surprises were things that only worked locally.