Everything you should know about certificates and PKI but are too afraid to ask
1–10 of 54 posts
Re: Everything you should know about certificates and PKI but are too afraid to ask
#2This is really good. Reformat it and turn it in to a book. Market it as essential reading for anyone running or thinking about running kubernetes or vault.
Edit: actually this is way more in depth than is needed for k8s. But, I think that's a good target market for a book you can sell like candy for $25.
Re: Everything you should know about certificates and PKI but are too afraid to ask
#3This is really good. Reformat it and turn it in to a book. Market it as essential reading for anyone running or thinking about running kubernetes or vault. Edit: actually this is way more in depth than is needed for k8s. But, I think that's a good target market for a book you can sell like candy for $25.
I'm curious - I've never seen tech books that short that people actually buy. Could you link some example?
The closest I know of are the Julia Evans' zines, but I think you meant something different.
Re: Everything you should know about certificates and PKI but are too afraid to ask
#4The other day I noticed that most mail doesn’t come through when disabling TLS 1.0 & TLS 1.1. To my dismay it seems some major smtp service don’t support TLS 1.2. After enabling 1.0 & 1.1 mail came rolling in.
Anyone able to shed some light on what happened there to me?
Re: Everything you should know about certificates and PKI but are too afraid to ask
#5At work, on Chrome I get this error: `ERR_SSL_PROTOCOL_ERROR`... oh the irony.
Re: Everything you should know about certificates and PKI but are too afraid to ask
#6At work, on Chrome I get this error: `ERR_SSL_PROTOCOL_ERROR`... oh the irony.
That’s weird. Screen shot or something?
(Edit: work at smallstep; want to fix)
Re: Everything you should know about certificates and PKI but are too afraid to ask
#7This is really good. Reformat it and turn it in to a book. Market it as essential reading for anyone running or thinking about running kubernetes or vault. Edit: actually this is way more in depth than is needed for k8s. But, I think that's a good target market for a book you can sell like candy for $25.
I'm curious - I've never seen tech books that short that people actually buy. Could you link some example? The closest I know of are the Julia Evans' zines, but I think you meant something different.
Here's an example on GTFS. https://gumroad.com/l/gtfsbundle
Re: Everything you should know about certificates and PKI but are too afraid to ask
#8Thanks for sharing, this kind of information is really rare and useful because A LOT of (techincal) people just don't understand PKI and certificates properly.
Also you've mentioned in the section “Naming things” that DN is deprecated, strictly speaking it's not. The Subject field is deprecated when browser matches certificate with domain, DN is still perfectly valid and Subject field MUST contain a proper DN as stated in https://tools.ietf.org/html/rfc5280#section-4.1.2.6.
Re: Everything you should know about certificates and PKI but are too afraid to ask
#9Thanks for sharing, this kind of information is really rare and useful because A LOT of (techincal) people just don't understand PKI and certificates properly. Also you've mentioned in the section “Naming things” that DN is deprecated, strictly speaking it's not. The Subject field is deprecated when browser matches certificate with domain, DN is still perfectly valid and Subject field MUST contain a proper DN as stat…
Actually it seems there is a mixup in the original text between DN (Distinguished Name) and CN (Common Name). The former is a generic term for a structured X.500 name, the latter a specific field in the Subject Name of a certificate, which is technically a DN.
The convention used to be that the CN field must match the DNS name of the server in a server TLS certificate, but this feature is indeed deprecated and the DNS name extension should be used instead.
Re: Everything you should know about certificates and PKI but are too afraid to ask
#10Thanks for sharing, this kind of information is really rare and useful because A LOT of (techincal) people just don't understand PKI and certificates properly. Also you've mentioned in the section “Naming things” that DN is deprecated, strictly speaking it's not. The Subject field is deprecated when browser matches certificate with domain, DN is still perfectly valid and Subject field MUST contain a proper DN as stat…
Some SANs are more equal than others