The perimeter around the estate, and the encryption inside it. Firewall deployment and network segmentation on one side; certificate enrolment, configuration and lifecycle management on the other. Both are areas where the failure is sudden, visible and entirely preventable — and both use an open-source platform rather than a subscription appliance, for the same reason as everything else here.
Firewall and network segmentation
OPNsense
Open-source firewall and network security. Sizing, deployment, policy design, segmentation, VPN and intrusion prevention — with the device itself monitored.
Product page →
Visit the OPNsense website
The official site of the OPNsense project, maintained by Deciso B.V.. Opens in a new tab — hold Ctrl (⌘ on a Mac) or middle-click to keep it in the background.
opnsense.orgSSL/TLS certificate services
SSL/TLS certificate enrolment, configuration and lifecycle management — across web servers, application servers, databases, security appliances and directory services.
Certificates are a small piece of engineering with a disproportionate failure mode: an expired certificate on a public-facing service is a visible outage, and on an internal service it is an outage nobody can immediately explain. We handle enrolment from public certificate authorities, set up an internal CA where you would rather not depend on one, configure the certificates correctly on each platform, and put renewal on a tracked schedule.
- CA enrolment. Procurement and issuance from public certificate authorities, including CSR generation and validation handling.
- Internal CA setup. A private certificate authority for intranet services, so internal encryption does not depend on an external provider.
- Platform configuration. Correct installation and cipher configuration per platform — not just dropping the file in place.
- Database encryption in transit. Enforced TLS for PostgreSQL, MySQL and SQL Server connections, including client-side configuration.
- Chain and trust validation. Intermediate chains installed correctly, so the certificate validates on every client rather than most of them.
- Apache HTTP Server
- Nginx
- Apache Tomcat
- Microsoft IIS
- Active Directory Certificate Services
- Security appliances and firewalls
- PostgreSQL
- MySQL / MariaDB
- Microsoft SQL Server
- Load balancers and reverse proxies
Why these sit together
An expired certificate and an unsegmented network fail in the same way: quietly, until the moment they do not. Both are also areas where the work is well understood and the tooling is mature — the gap is almost always that nobody owns the lifecycle.
So we build ownership into the deployment. Certificates become tracked assets with expiry alerting. Firewall configuration is documented with the intent behind each rule, and device health is monitored alongside everything else. Neither becomes a black box only one person understands.
