## 2. Use an Existing Key and Certificate with MinIO

         * for the addresses hostname or failed lookups for one type will
         * be cached and cause other types to fail even though they may
         * not be the authority for the name. For example, if a WINS lookup
         * for FOO fails and caches unknownAddress for FOO, a subsequent
         * lookup for FOO using BCAST should not fail because of that
         * name cached from WINS.

128 bit numbers which are intended to have a high likelihood of uniqueness over space and time and are computationally difficult to guess. They are globally unique identifiers which can be locally generated without contacting a global registration authority. UUIDs are intended as unique identifiers for both mass tagging objects with an extremely short lifetime and to reliably identifying very persistent objects across a network.

When you PUT an object in a versioning-enabled bucket, the noncurrent...

<img src="/img/deployment/https/https.svg">

The **TLS certificates** are **associated with a domain name**, not with an IP address.

So, to renew the certificates, the renewal program needs to **prove** to the authority (Let's Encrypt) that it indeed **"owns" and controls that domain**.

To do that, and to accommodate different application needs, there are several ways it can do it. Some popular ways are:

* **Modify some DNS records**.

                  "name": "inbound-vip|8100||httpbin.default.svc.cluster.local-http"
                },
                {
                  "filters": [
                    {
                      "name": "connect_authority",
                      "typed_config": {
                        "@type": "type.googleapis.com/envoy.extensions.filters.network.set_filter_state.v3.Config",
                        "on_new_connection": [

   * signed by the compromised CA's certificate and uses it in a non-CA certificate. They ask the
   * pinned CA above to sign it for non-certificate-authority uses:
   *
   * ```
   *   pinnedRoot (trusted by CertificatePinner)
   *     -> pinnedIntermediate (trusted by CertificatePinner)
   *         -> attackerSwitch
   * ```
   *

takes place. type: string retryRemoteLocalitie: description: Flag to specify whether the retries should retry to other localities. nullable: true type: boolean type: object rewrite: description: Rewrite HTTP URIs and Authority headers. properties: authority: description: rewrite the Authority/Host header with this value. type: string uri: description: rewrite the path (or the prefix) portion of the URI with this value. type: string uriRegexRewrite: description: rewrite the path portion of the URI with...

     * @param streamId client-initiated stream ID.  Must be an odd number.
     * @param promisedStreamId server-initiated stream ID.  Must be an even number.
     * @param requestHeaders minimally includes `:method`, `:scheme`, `:authority`, and `:path`.
     */
    @Throws(IOException::class)
    fun pushPromise(
      streamId: Int,
      promisedStreamId: Int,
      requestHeaders: List<Header>,
    )

    /**

    val expectedPromisedStreamId = 11
    val pushPromise =
      listOf(
        Header(Header.TARGET_METHOD, "GET"),
        Header(Header.TARGET_SCHEME, "https"),
        Header(Header.TARGET_AUTHORITY, "squareup.com"),
        Header(Header.TARGET_PATH, "/"),
      )

    // Write the push promise frame, specifying the associated stream ID.
    val headerBytes = literalHeaders(pushPromise)

                 * for the addresses hostname or failed lookups for one type will
                 * be cached and cause other types to fail even though they may
                 * not be the authority for the name. For example, if a WINS lookup
                 * for FOO fails and caches unknownAddress for FOO, a subsequent
                 * lookup for FOO using BCAST should not fail because of that