3 ms·
CRL and OSCP have been asked for for a very long time! I don't see them coming anytime soon. The golang TLS library author has a thing against them, so chose t
by kiallmacinnes 8y ago
CRL and OSCP have been asked for for a very long time! I don't see them coming anytime soon.
The golang TLS library author has a thing against them, so chose to not implement them[0].
Personally, I think he's wrong. He's describing a web browser style use case and not an internally managed CA for a single specific service, and he's then applied that reasoning to a languages TLS library. And it's left essentially all TLS in golang without revocation support.
For Kubernetes, you'll need to wire up nginx/haproxy whatever in front of every endpoint to do TLS+CRL checks before handing off the connection to the actual backend (kube-api, kubelet, etc) over 127.0.0.1 (still with SSL! Lookback is not safe when untrusted code is running on your server..).
[0]: https://www.imperialviolet.org/2014/04/19/revchecking.html https://www.imperialviolet.org/2014/04/19/revchecking.html