yum install tinyca
TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
21–30 of 40 posts
Re: TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
#22They mention StartSSL for production certificates. Beware that while creating certificates with them is gratis, REVOKING them will cost you money. https://www.techdirt.com/articles/20140409/11442426859/shame...
They actually have the most reasonable business model, as they only charge you for services where human interaction is required (fe checking your credentials or adding your certificate to the revocation list), anything else like signing your certificate is free.
Note that StartSSL certificates are only free for "non-commercial" use, where "non-commercial" is not a clearly defined term, e.g. if you domain name contains businessy terms , such as "sell", they will refuse to issue a free cert.
Re: TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
#23Earlier quoted context omitted.
We know. They say very clearly on the front page that one of their advantages is: > Generate and manage SSL certificates quickly and easily without looking up complex OpenSSL commands.
But openssl commands aren't complex. Confusion ensues.
I tried generating a self-signed certificate that had multiple SANs the other day and just gave up because I couldn't get it working.
Re: TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
#24The fact that they keep your private keys in their database is what makes this a bad idea to use. Cannot see what kind of people this service is targeted to, since the ones who understand what a CA is and need to sign their own certificates probably already know how to use OpenSSL.
OpenSSL's CLI is pretty annoying, and for many (like me!) it mostly consists of copy-pasting commands into a text editor, modifying them slightly, and pasting them into a terminal. Could be better. But yeah, trusting a third party with your private keys isn't an answer.
Maybe look at Dogtag Certificate System
Re: TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
#25I quite like the idea of TinyCert and often wanted to do something similar myself. Although creating a private CA is not a lot of work initially, maintaining it is a hassle, especially when you'd rather be doing something else. TinyCert could be useful for development teams (and other similar non-security-critical uses) to get rid of self-signed certificates altogether. However, for me, the fact that they have all th…
I agree with maintaining is a hassle, but creating a private CA is also not that easy. I was building up my own CA, there was still a lot of stuff to take care of, from policies/keyUsages to CRL/OCSP/SECP, when ECC comes in, encryption and decryption usages sometimes could be separated. There's whole lot of tiny little details somewhere makes me to rebuild the CA. I'm on G32 revision.
And the nitrokeys are great, I've never expected an affordable HSM for home/private use, thank you for mentioning it. I think I'm going to roll out G33 ;p
Re: TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
#26As others said, the whole point of having your own CA is that you have full trust and control over it. If you give someone your root ca private key then you may as well not have your own PKI at all (I can't see the point).
re cli - pain^2 , I ended up using xca
Re: TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
#27It could be i'm totally missing the use-case for this, but personally I think if you can't take the 30 minutes to google one of the hundreds of guides that use OpenSSL commands and precompiled win32 binaries to generate three files you shouldn't be trusted with providing security for a website. Who are these people who need SSL and don't have 30 minutes to learn this once? There are tons of scripts and other tools th…
The trend these days seems to be turning everything into a service.
Re: TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
#28Not sure i got it right – is it some kind of self-signed/untrusted certificate generation as-a-service?
Re: TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
#29They mention StartSSL for production certificates. Beware that while creating certificates with them is gratis, REVOKING them will cost you money. https://www.techdirt.com/articles/20140409/11442426859/shame...
I tried to setup some a SSL cert through StartSSL and hit the paywall when I wanted to create a cert for a sub domain. The fees to get class 2 verification cost more than buying a basic SSL elsewhere.
Re: TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
#30Earlier quoted context omitted.
But openssl commands aren't complex. Confusion ensues.
I tried generating a self-signed certificate that had multiple SANs the other day and just gave up because I couldn't get it working.
It doesn't sound like you had trouble with the CA part of OpenSSL if you created a self-signed cert from the command line.
It might be that there's no (that I know of!) convenient way to specify extensions such as SAN on the command line. You have to do it via a configuration file, which you in turn pass as an argument. And that's probably the way you want to do it anyway if you script things!
As long as you do it that way there should be no problems with signing certificates, with or without extensions.