4 ms·

Our development server at work is authenticated using client-side certificates that I install on every employee's computer (along with our Root CA cert). This t

Our development server at work is authenticated using client-side certificates that I install on every employee's computer (along with our Root CA cert). This takes me about 5 minutes to generate for them [1] and another 2 minutes to put into their OSX keychain. It's fun to sit there with each person and show them what I'm doing and how this wonderful system works. But if I asked ANY ONE of them to do ANY step along the way, they'd throw their hands up and quit. My brother who is extremely tech competent can't do this. I like these suggestions but I just don't know fundamentally if this system can be used by people without a drastic overhaul to the UI. [1] https://github.com/TeachBoost/pki https://github.com/TeachBoost/pki

Diederich 11y ago
It's kind of a pain, but I wonder if you could, in whatever level of detail you would like to provide, walk us through the steps you take, especially the more 'throw their hands up and quit' ones. If you don't want to, I totally understand!
- mikegioia 11y ago
  I absolutely can. I know that project I listed has 0 documentation, but I should rip out the code and move it to another repo with a README. The short of it is that I run the following. (I know this repo has our public keys, but if you clone it you can totally run this as well to see what's going on). ./bin/root-ca.sh ./bin/tls-ca.sh ./bin/client.sh The first command will create the Root Certificate Authority in your tiered system. The second one will create a TLS Certificate Authority underneath the Root. This TLS CA is for issuing certificates (like browser client certificates, or email S/MIME certificates). Finally, the last script will walk you through creating one of these client certs. The client.sh script will generate a .p12 file that you can import into Keychain or your browser's certificate store. The only other step is to import the Root certificate (mine is TeachBoostRootCA.crt in the ca folder) into Keychain and/or your browser. If you're curious, take a look at the config file in the top level directory. This has all of the naming conventions my repo uses but if you clone this, clear the 'ca', 'certs', and 'crl' folders, then you can have free reign on running your own Certificate Authority. The scripts will walk you through everything but if you have any questions don't hesitate to open a GH issue on that repo and I'll get back to you there.
  - Diederich 11y ago
    Thanks! I will take a peek at it.
shazow 11y ago
You might also like cloudflare's cfssl toolsuite: https://github.com/cloudflare/cfssl https://github.com/cloudflare/cfssl I've reduced most of my cert-generating to just a one-liner and a JSON metadata file. For example: https://twitter.com/shazow/status/582262725683777536 https://twitter.com/shazow/status/582262725683777536
- mikegioia 11y ago
  Wow, thanks for that link. That's an awesome set of tools.
ams6110 11y ago
This is my observation as well. Smart people, e.g. people with PhDs or working on them, just by and large do not understand key pairs. They have terrible trouble with ssh keys, and I am sure would have as much or more trouble with client certificates. It has to be something that is totally automated, and can't rely on copying or uploading or in any way touching public keys as a manual step.
- nine_k 11y ago
  Doesn't Diffe-Hellman allow to generate a key pair without manual intervention?
brianclements 11y ago
It's even hard for those trying to understand it (I'll speak for myself coming from a non-CS background), and that's not even the same battle as implementing all the separate parts in an efficient way day to day. I've worked on my own bash cli tool[1] for more efficient openssl usage and mentioned it here before.[2] Only after that project was I able to finally understand the concepts enough to use the thing at all. [1]https://github.com/brianclements/pkictl https://github.com/brianclements/pkictl [2]https://news.ycombinator.com/item?id=10257074 https://news.ycombinator.com/item?id=10257074

Diederich 11y ago

It's kind of a pain, but I wonder if you could, in whatever level of detail you would like to provide, walk us through the steps you take, especially the more 'throw their hands up and quit' ones. If you don't want to, I totally understand!

mikegioia 11y ago
I absolutely can. I know that project I listed has 0 documentation, but I should rip out the code and move it to another repo with a README. The short of it is that I run the following. (I know this repo has our public keys, but if you clone it you can totally run this as well to see what's going on). ./bin/root-ca.sh ./bin/tls-ca.sh ./bin/client.sh The first command will create the Root Certificate Authority in your tiered system. The second one will create a TLS Certificate Authority underneath the Root. This TLS CA is for issuing certificates (like browser client certificates, or email S/MIME certificates). Finally, the last script will walk you through creating one of these client certs. The client.sh script will generate a .p12 file that you can import into Keychain or your browser's certificate store. The only other step is to import the Root certificate (mine is TeachBoostRootCA.crt in the ca folder) into Keychain and/or your browser. If you're curious, take a look at the config file in the top level directory. This has all of the naming conventions my repo uses but if you clone this, clear the 'ca', 'certs', and 'crl' folders, then you can have free reign on running your own Certificate Authority. The scripts will walk you through everything but if you have any questions don't hesitate to open a GH issue on that repo and I'll get back to you there.
- Diederich 11y ago
  Thanks! I will take a peek at it.

shazow 11y ago

You might also like cloudflare's cfssl toolsuite: https://github.com/cloudflare/cfssl https://github.com/cloudflare/cfssl I've reduced most of my cert-generating to just a one-liner and a JSON metadata file. For example: https://twitter.com/shazow/status/582262725683777536 https://twitter.com/shazow/status/582262725683777536

mikegioia 11y ago
Wow, thanks for that link. That's an awesome set of tools.

ams6110 11y ago

This is my observation as well. Smart people, e.g. people with PhDs or working on them, just by and large do not understand key pairs. They have terrible trouble with ssh keys, and I am sure would have as much or more trouble with client certificates. It has to be something that is totally automated, and can't rely on copying or uploading or in any way touching public keys as a manual step.

nine_k 11y ago
Doesn't Diffe-Hellman allow to generate a key pair without manual intervention?

brianclements 11y ago

It's even hard for those trying to understand it (I'll speak for myself coming from a non-CS background), and that's not even the same battle as implementing all the separate parts in an efficient way day to day. I've worked on my own bash cli tool[1] for more efficient openssl usage and mentioned it here before.[2] Only after that project was I able to finally understand the concepts enough to use the thing at all. [1]https://github.com/brianclements/pkictl https://github.com/brianclements/pkictl [2]https://news.ycombinator.com/item?id=10257074 https://news.ycombinator.com/item?id=10257074