3 ms·
I'm sure people make plenty of money wrapping OpenSSL in ever more elaborate Enterprise schemes. But if the net effect is that one bug in a frontend can cause
by revelation 10y ago
I'm sure people make plenty of money wrapping OpenSSL in ever more elaborate Enterprise schemes.
But if the net effect is that one bug in a frontend can cause the server to tell the cert server to tell the secure enclave to tell the wire mesh protected crypto coprocessor to sign a bogus certificate then what are we really doing here.
- Spooky23 10y agoThey sure do! We have an offline root on an HSM for various reasons. We looked at various systems to manage intermediate ca issuance and reminders for renewal and the cost was incredible... most were >$200k! Using scripts to automatically generate certificates and using the ugly but effective Windows CA web interface for "vanity" stuff does 90% of what those solutions do. I think we had an intern write a monitoring plugin to open tickets for soon to expire certificates and a few other things that covered the remaining 10%.