2 ms·
A way to work around this is to normally work with short term certificate (24h) and allow your systems people to generate longer term certificates (one month) t
by antoinealb 6y ago
A way to work around this is to normally work with short term certificate (24h) and allow your systems people to generate longer term certificates (one month) that are stored encrypted on their laptop or usb key.
That way you get both emergency access in case LDAP is broken, as well as a way to make sure old personal access gets revoked after one month.
- _jal 6y agoYep. I'm a big fan of Hashicorp Vault; that's the next step. There are of course also DR considerations for that, as always, it is turtles all the way down.