4 ms·
It’s possible to generate private keys on a HSM like YubiKey to be a CA and perform signing of certs via a hardware function. Operations can make the difference
by harlanji 7y ago
It’s possible to generate private keys on a HSM like YubiKey to be a CA and perform signing of certs via a hardware function. Operations can make the difference; but given an offline SBC and 2+ YKs a robust, affordable, and friendly solution could be devised. A similar reference implementation would be IBM Hyperledger Fabric’s security w/ CA (the doc is good and team responsive).
- Avamander 7y agoSmart cards with a TLS client cert auth? Estonia does it, works great for logging in if the service supports it.