Encryption and API protection: TLS, HSTS, PFS, secret rotation

1) Threat picture and targets

APIs under MitM attack, traffic interception, downgrade attacks, token spoofing, key leaks, and abuse of long-lived secrets. Protection objectives:

Confidentiality and Integrity (TLS 1. 3 + strong ciphers).
Protection against downgrade/stripping (HSTS, prohibited versions/ciphers).
Minimizing compromise damage (PFS, short TTL, rapid rotation).
Reliable client/service authentication (mTLS/tokens) and traceability.

2) TLS as a basis (server and service-to-service)

Versions and ciphers:

The default is TLS 1. 3; allow TLS 1. 2 for compatibility only. Disable 1. 1/1. 0.

Priority encryption TLS 1. 3:

`TLS_AES_128_GCM_SHA256`, `TLS_AES_256_GCM_SHA384`, `TLS_CHACHA20_POLY1305_SHA256`.
For TLS 1. 2: only ECDHE with AES-GCM/ChaCha20 and ECDSA/RSA signature (e.g. 'ECDHE-ECDSA-AES128-GCM-SHA256').

Keys and certificates:

Server keys: ECDSA P-256/P-384 (faster and shorter) or RSA 2048 +/3072.
Client keys for mTLS: ECDSA P-256; issuance through your own CA or payment HSM/KMS.
Enable OCSP stapling, preferably with the Must-Staple flag, and ALPN (HTTP/2/3).

PFS (Perfect Forward Secrecy):

Provided by ephemeral exchanges (ECDHE) - even if the server key has leaked, past sessions cannot be decrypted.
Force a static DH/RSA key agreement.

Modern additions:

ECH (Encrypted Client Hello), if supported by the front/CDN, hides the SNI.
HTTP/2/3 only with strong ciphers; prohibition of unprotected HTTP, redirect to HTTPS.

3) HSTS vs TLS-stripping

Enable HTTP Strict Transport Security on the root domain and subdomains:


Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Place the domain in the HSTS preload list.

Watch for correctness before publishing (rollback is difficult).

4) Mutual authentication: mTLS and/or tokens

mTLS between microservices/internal APIs: bi-directional certificates, automatic rotation via service mesh (Istio/Linkerd) or proprietary PKI.

API clients (mobile/partner integrations): tokens (OAuth2/OIDC, JWT), optional mTLS for high-risk.

For public fronts: TLS + short-lived OAuth2/OIDC tokens with device/DPoP binding.

5) Certificate and lifecycle management

ACME automation (for example, Let's Encrypt/Organizational CA) with auto-update 30 days before expiration.

Short life of certificates (≤ 90 days) + monitoring of deadlines, alerts and canary deploy packets.

Centralized PKI: root/intermediate CA, CRL/OCSP, audit releases and revocation.

Example of nginx (fragment):

nginx ssl_protocols TLSv1. 3 TLSv1. 2;
ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256;
ssl_prefer_server_ciphers on;
ssl_ecdh_curve X25519:P-256:P-384;
ssl_stapling on; ssl_stapling_verify on;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

6) Secret Rotation: Principles and Patterns

Rotation goals: limit the "explosive radius" of leaks, reduce abuse time, and ensure seamless releases.

Basic rules:

Storing secrets only in the secret manager (KMS/Vault/Cloud SM). No secrets in Git/images.
Short TTL and automatic rotation: signature keys, database passwords, provider API keys.
Dual-key window: The old and new keys are active simultaneously for the roll period.
Versioning + kid (for JWT/JWKS), "grace" window for validating old tokens.

What to rotate regularly:

JWT keys (signature/encryption), HMAC secrets of webhooks and callbacks, Passwords/database accounts, caches (Redis), CI/CD tokens, Provider secrets (KYC/AML, payments, SMS/e-mail), SSH - automation keys.

Triggers of unscheduled rotation: suspicion of leakage, dismissal of employees with access, change of supplier, requirements of the regulator.

7) JWT/JWKS: Safe Role Overlay

Publish JWKS endpoint with current and future key ('kid' required).

Rotation procedure:

1. Generate a new key → add it to the JWKS as a "second" key.

2. Update signatories → issue new tokens with a new key.

3. Wait for the TTL of old tokens → remove the old key from the JWKS.

Install short TTL tokens (for example, 5-15 minutes) + refresh streams with additional verification.

8) Secret management in practice

KMS + envelope encryption: master key in HSM/KMS, data is encrypted with "wrapped" DEK.

Vault/Cloud Secret Manager: dynamic credits to the database (issuance of records with TTL), periodic rotation.

Kubernetes: External Secrets/Secrets Store CSI; etcd encryption; RBAC; prohibition of logging secrets.

Role access: IAM/ABAC, principle of least privileges, hardware boundaries (HSM, TPM).

Full audit: who, what, when, why read/changed.

9) Transport protection inside the perimeter

Do not trust the "internal network": everywhere TLS/mTLS (zero-trust).

Service mesh automates certificates, restart and rotation, observability (mTLS by default).

Minimize TLS termination: either edge + encrypted east-west only, or end-to-end encryption.

10) API over TLS security policies

Rate limiting/DoS protection, verification of webhook signatures (HMAC with secret rotation).

Content-Security-Policy/Referrer-Policy/X-Content-Type-Options для фронта.

mTLS for critical endpoints (payments, admin panel), IP allow-list by partners.

Replay protection: timestamp + nonce in signed requests, windows no more than 5 minutes.

11) Monitoring and tests

Observability of TLS: versions/ciphers in metrics, alerts to downgrade attempts, an increase in handshake failures.

Scanners (in CI/CD and regularly in sales): checking supported ciphers, certificates, HSTS, OCSP.

Chaos/DR exercises: certificate expiration, secret manager drop, signature key compromise - check reaction plans.

12) Response procedures

Key compromise: immediate certificate revocation/key removal from JWKS, reversal to backup, forced token regeneration.

Expiration without renewal: temporary degradation (internal traffic only), automatic reinstallation of certificates.

Incident Report: Timeline, Affected Subjects, Tech. parts, corrective measures.

13) Quick Check Checklist (prod-ready)

TLS 1 only. 3 (+ 1. 2 for legasi), a strict list of ciphers.
HSTS с `preload`, OCSP stapling, ALPN.
ECDHE for PFS; ECDSA P-256/384 or RSA 3072.
mTLS within the cluster/between critical services.
JWKS + kid, short TTL tokens, rotation plan.
Secrets - only in KMS/Vault, auto-rotation of databases/providers.
Auto-renewal of certificates (ACME), alerts in 30 days.
CI/CD check of security headers and vulnerable ciphers.
Documented runbook 'and: rotation, recall, incidents.

Resume Summary

Reliable API protection is a combination of TLS 1. 3 + HSTS + PFS as a mandatory minimum and mature key and secret management processes. Add mTLS between services, automate release/rotation via KMS/Vault/mesh, keep short TTLs and double windows when changing keys - and you will minimize the risks of interception, downgrade and abuse of leaked secrets without breaking the availability and speed of the product.