21–25 of 25 posts
While helper scripts for OpenSSLs arcane syntax are highly appreciated, running some .sh file downloaded from the Internet is not the wisest of security ideas. The author (or somebody from GitHub) could just replace this script with one that actually uploads your freshly-generated private key to somewhere.
Earlier quoted context omitted.
If an attacker can get access to your (encrypted) private key file, you have other things to worry about. And the passphrase doesn't help against memory-based attacks (e.g. Heartbleed) anyway. A passphrase is mostly a hassle; someone will have to enter it after maintenance or (worse) a power outage.
The fact that you make several valid points doesn't mean keys shouldn't default to having passphrases. Yes, there are attack vectors which having a passphrase doesn't protect against. Yes, passphrases require additional considerations when starting services. No, this doesn't mean they're "mostly a hassle". No, you probably shouldn't default to passphraseless keys.
Would having a default that's the opposite of what nearly all users want be sensible?
This can be a one-liner in openssl: openssl req -new -sha256 -x509 -days 365 -newkey RSA:4096 -nodes -keyout domain.key -subj "/CN=example.com" -reqexts SAN -config For a CSR, the same technique can be used: openssl req -new -sha256 -newkey RSA:4096 -nodes -keyout domain.key -subj "/CN=example.com" -reqexts SAN -config
We should also notify the differences : I have compared both and have noticed your oneliner generates a CA certificate (which may not be what we want). Also the oneliner rely on the /etc/ssl/openssl.conf file which can change over the time, so the generated certificate may be affected too
This can be a one-liner in openssl: openssl req -new -sha256 -x509 -days 365 -newkey RSA:4096 -nodes -keyout domain.key -subj "/CN=example.com" -reqexts SAN -config For a CSR, the same technique can be used: openssl req -new -sha256 -newkey RSA:4096 -nodes -keyout domain.key -subj "/CN=example.com" -reqexts SAN -config
It works too thanks. We should also notify the differences : I have compared both and have noticed your oneliner generates a CA certificate (which may not be what we want). Also the oneliner rely on the /etc/ssl/openssl.conf file which can change over the time, so the generated certificate may be affected too
Earlier quoted context omitted.
Yeah, I know. That was awful and should have resulted in policy changes; it hasn't, and I don't use Debian any more. But it makes a good example of the right approach to package infrastructure.
Is there a distro with a stronger policy than Debian? what are you using now?