3 ms·

Huh? A modern infrastructure setup should have PKI in place to issue certificates to nodes. You are making it sound like SSL has no place in the modern world.

by ants_a 8y ago

jillesvangurp 8y ago
Not making that point at all. Just making the point that related certificates and keys need to be looked up at run time from some secure place rather than be provisioned onto a file system at build time or via some hard to automate sysadmin ritualistic dance on the command line post startup. If in amazon, the secure parameter store is a good place for storing secrets. They also provision nice EC 2 credentials to hosts allowing you to access resources securely without having to rely on silly ssh keys baked into images or passwords passed around insecurely. And of course they allow you to centrally manage ssl certificates as well and manage provisioning those to things like load balancers. Kubernetes has nice infrastructure for this as well. The point is that this stuff should never be baked into docker or ec2 images and having software expecting to find these things in some file on the filesystem actively makes it harder to configure it in a sane way. I've seen quite a few docker images that require me to mount a volume with certificate files to work at all. The only way to beat some sense into that is to customize the Docker file and template these files (e.g. dockerize is great for this). Sane deployment automation seems to be an afterthought with many developers. Since you brought up SSL, a nice innovation a few years ago was https://letsencrypt.org/ https://letsencrypt.org/ which uses short lived certificates that need to be renewed regularly. That sounds like a good practice to do anywhere you use any kind of ssl connections. That would require automation to refresh those certificates of course. Not just once on startup but also before they expire. However, if the software reads keys only once at startup from a file, part of that scripting is also becomes orchestrating a restart; which I imagine can get a bit hairy in the case of a clustered database product.

Huh? A modern infrastructure setup should have PKI in place to issue certificates to nodes. You are making it sound like SSL has no place in the modern world.

by ants_a 8y ago

Huh? A modern infrastructure setup should have PKI in place to issue certificates to nodes. You are making it sound like SSL has no place in the modern world.

jillesvangurp 8y ago

Not making that point at all. Just making the point that related certificates and keys need to be looked up at run time from some secure place rather than be provisioned onto a file system at build time or via some hard to automate sysadmin ritualistic dance on the command line post startup. If in amazon, the secure parameter store is a good place for storing secrets. They also provision nice EC 2 credentials to hosts allowing you to access resources securely without having to rely on silly ssh keys baked into images or passwords passed around insecurely. And of course they allow you to centrally manage ssl certificates as well and manage provisioning those to things like load balancers. Kubernetes has nice infrastructure for this as well. The point is that this stuff should never be baked into docker or ec2 images and having software expecting to find these things in some file on the filesystem actively makes it harder to configure it in a sane way. I've seen quite a few docker images that require me to mount a volume with certificate files to work at all. The only way to beat some sense into that is to customize the Docker file and template these files (e.g. dockerize is great for this). Sane deployment automation seems to be an afterthought with many developers. Since you brought up SSL, a nice innovation a few years ago was https://letsencrypt.org/ https://letsencrypt.org/ which uses short lived certificates that need to be renewed regularly. That sounds like a good practice to do anywhere you use any kind of ssl connections. That would require automation to refresh those certificates of course. Not just once on startup but also before they expire. However, if the software reads keys only once at startup from a file, part of that scripting is also becomes orchestrating a restart; which I imagine can get a bit hairy in the case of a clustered database product.