Mac OS X and CSSMERR_TP_INVALID_CERTIFICATE
Pinpoint a Safari and Keychain validation failure that OpenSSL may quietly accept, saving hours of chasing misleading CSSM errors and apparent hostname-spoofing warnings.
Creating subaccounts for Amazon's S3 storage service.
Give servers and scripts narrowly scoped S3 credentials instead of exposing your master AWS keys, using IAM users and bucket policies—even when the console leaves you with Java CLI tooling and policy JSON.