TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
1–10 of 40 posts
Re: TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
#2I believe this was mentioned last time TinyCert appeared on HN, but a self-hosted version of this would be more ideal.
I personally use etcd-ca[0] to ease management of my own certificates.
Re: TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
#3There is CA functionality included in basic OpenSSL:
Re: TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
#4Not open source.
Re: TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
#5There is CA functionality included in basic OpenSSL: https://www.openssl.org/docs/manmaster/apps/ca.html
We know. They say very clearly on the front page that one of their advantages is:
> Generate and manage SSL certificates quickly and easily without looking up complex OpenSSL commands.
Re: TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
#6The fact that they keep your private keys in their database is what makes this a bad idea to use.
Cannot see what kind of people this service is targeted to, since the ones who understand what a CA is and need to sign their own certificates probably already know how to use OpenSSL.
Re: TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
#7There is CA functionality included in basic OpenSSL: https://www.openssl.org/docs/manmaster/apps/ca.html
We know. They say very clearly on the front page that one of their advantages is: > Generate and manage SSL certificates quickly and easily without looking up complex OpenSSL commands.
But openssl commands aren't complex. Confusion ensues.
Re: TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
#8Not open source.
I know. I've discussed this with the author, there are some IP issues he's trying to resolve. Outside of this obstacle, his desire is to open-source it.
Re: TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
#9They mention StartSSL for production certificates. Beware that while creating certificates with them is gratis, REVOKING them will cost you money. https://www.techdirt.com/articles/20140409/11442426859/shame...
Re: TinyCert – Become Your Own PKI/CA Authority in a Matter of Minutes
#10While not the only one out there[1], I've been hacking a cli tool written in bash[2] to streamline the OpenSSL commands geared toward a PKI/CA workflow. I started it mainly for my overall learning of OpenSSL from nothing and for my small scale needs with my CoreOS servers.
What I learned from this exercise, is that it's not the complexity of the commands that is the issue with OpenSSL, it's:
1) The importance of consistent naming schemes (for the humans) and PKI hierarchy design (the nuances of keyUsage, basicConstraints, and extendedKeyUsage)
2) consistent execution of commands; typos are more likely the more you have to put in the CLI manually
3) good configuration files aren't utilized enough in most of the tutorials I found. They can streamline use, archive procedure, and prevent typos as in point #2.
4) The importing of certs and keys in an automatic way is a sort of dark corner of the tutorial world. But permissions are super important! I came up with an import strategy that I think works pretty well.[3] Please examine and break it!
[1]https://github.com/OpenVPN/easy-rsa