#pki · Elektrine

· 3mo ago

One SSL cert, three servers. Which one generates the private key? Generate-where-used breaks once a cert is shared. The key moves anyway. Design that, or it becomes scp in a cron job. https://www.certkit.io/blog/ssl-certificate-multiple-servers #SSL #PKI

CertKit SSL Certificate Management

One SSL certificate on multiple servers

Generating the private key on the server it protects is the textbook answer. Then someone asks for a wildcard, or a second server, and the textbook doesn't have a chapter for that.

tod @tod@mastodon.tod.net

· 3mo ago

Part 5 of my homelab downsizing series: a week building the wrong cert automation (acme-proxy — turns out it doesn't support Cloudflare DNS-01), then six days and three attempts standing up FreeIPA as a subordinate CA before shelving it for Samba AD. Two burned signing ceremonies, one silently-discarded private key. #homelab #pki #freeipa #selfhosted https://homelab.tod.net/posts/downsizing-the-homelab/pki-decision-journal/

homelab.tod.net

https://homelab.tod.net/posts/downsizing-the-homelab/the-pki-detour/

CertKit @certkit@infosec.exchange

· 3mo ago

The longest SSL certificate you can buy today is 200 days. By 2029 it will be 47. Revocation never worked, so the industry is killing long lifespans instead. @toddhgardner@hachyderm.io broke down the why on RunAs Radio. https://runasradio.com/Shows/Show/1041 #SSL #PKI

RunAsRadio

47 Day Certificates with Todd Gardner

The 47-day certificate is coming! While at NDC in Toronto, Richard received an update from Todd Gardner about his show last year: certificate authorities are moving toward SSL certificates that last only 47 days! Todd talks...

You've seen all posts