Tls | inetshell

Google-managed certificate that never gets issued: CAA (pki.goog, letsencrypt.org), FAILED_NOT_VISIBLE and the right order

CAA with issue pki.goog and issue letsencrypt.org (or no CAA at all), A/AAAA pointing only to the load balancer IP, certificate attached to the target proxy, and up to 60 minutes. gcloud compute ssl-certificates describe shows the domainStatus that tells which of the three is failing.

iLO 2/3 and ERR_SSL_VERSION_OR_CIPHER_MISMATCH: opening the web UI from a modern browser

iLO 2 is stuck on TLS 1.0 and iLO 3 on TLS 1.1 forever. Firefox with deprecated TLS (separate profile) or Edge in IE mode opens the console; over SSH you can enforce AES and regenerate the certificate.