21–30 of 164 posts
Link: https://github.com/OpenVPN/easy-rsa
Summary from that page:
easy-rsa is a CLI utility to build and manage a PKI CA. In laymen's terms, this means to create a root certificate authority, and request and sign certificates, including intermediate CAs and certificate revocation lists (CRL).
Doesn't the first Apple link specifically say the 398-day limit doesn't apply to self-signed CAs? > This change will affect only TLS server certificates issued from the Root CAs preinstalled with iOS, iPadOS, macOS, watchOS, and tvOS. > This change will not affect certificates issued from user-added or administrator-added Root CAs. The second link about the other restrictions (including <=825 days validity) does appe…
I run a squid proxy with TLS intercept on a raspberry pi, with my own CA. I have things set up so that the RPi connects to a WiFi, and then a cable from the RPi goes to another WiFi router. I connect my MacBook Pro to that other router. This way the MacBook Pro cannot reach the internet. Then I set the http and https proxy configs in Firefox so that it goes via the squid on the RPi. And I have the root CA from the RP…
Using nitrokey and some glue scripts you can get the cost below $500. If anyone is interested, let me know.
I went with DNS based Let's Encrypt for internal certificates, since I'm okay leaking my internal DNS names. > An obvious downside of this is having to guard a bunch of secrets and the need to rotate the host certificates yearly – because Apple says so. The guarding secrets thing makes me too uncomfortable with managing my own CA. I'm sure it'd be fine, but since there are other equivalent and safer ways to do it.. N…
It's well supported now. I use it and it works for OpenSSL, Firefox, and Safari.
Personally, I don't think there's much to gain from using public PKI for internal infrastructure. I already manage secrets on my personal devices and this is no different. Also, being able to issue certs for .home.arpa domains is nice too.
I run a squid proxy with TLS intercept on a raspberry pi, with my own CA. I have things set up so that the RPi connects to a WiFi, and then a cable from the RPi goes to another WiFi router. I connect my MacBook Pro to that other router. This way the MacBook Pro cannot reach the internet. Then I set the http and https proxy configs in Firefox so that it goes via the squid on the RPi. And I have the root CA from the RP…
Earlier quoted context omitted.
Browsers won't offer to save passwords on self signed sites.
You might be able to get around this using the Chrome "flags" page, search for unsafely-treat-insecure-origin-as-secure.
This is not really an Apple thing, it's an industry trend (and a good one IMO). Apple's generally applying the same criteria Chrome is: https://chromium.googlesource.com/chromium/src/+/HEAD/net/do...
> This will only apply to TLS server certificates from CAs that are trusted in a default installation of Google Chrome, commonly known as “publicly trusted CAs”, and will not apply to locally-operated CAs that have been manually configured.
I eventually need to publish an article about how to run an HSM backed root CA on the cheap with m of n auth. Using nitrokey and some glue scripts you can get the cost below $500. If anyone is interested, let me know.