Cryptosystems are hard. I've been thinking a lot lately about cryptosystems, and my thinking is that there's entirely too much complexity in this space: What wo

Cryptosystems are hard. I've been thinking a lot lately about cryptosystems, and my thinking is that there's entirely too much complexity in this space: What works is keeping things simple. RE: CA Lists: Your CA list should be as short as it can be. The public CA list should be the public CA list, and you should use Mozilla's HTTPS list or Google's Chrome Root Store... but these lists are public lists for public infrastructure, and what you should use for communicating with services you don't control. Every company should have a CA. Possibly every division of every company. Don't throw them all in the same file. You should, as a client, make use of TLS Contexts: You should specify for every HTTPS Client a specific CA, which for internal services should be your own CA. As a server, client certificate auth is pretty rare (but it shouldn't be). When you do have it, you don't always have control over the client's root CA, but you shouldn't blindly trust it, either. You must verify that the claims on the client certificate match the claims on the CA, but also that the claims on the CA match your actual trust of the CA. The latter shouldn't be done at runtime, but during configuration. You shouldn't accept blind root signing certificates; You should accept from your clients intermediate CAs with appropriate constraints baked in. This brings into the equation another important problem: You shouldn't have complex claims on client certificates. I'm watching closely the SPIFFE project [1], which I believe is well intentioned but don't believe has got it right. I've also got my own project, KubeTLS[2] which implements a simple claims system - Which is appropriate in very limited constraints, but I believe those constraints also match most businesses real-world needs. [1] https://spiffe.io/ https://spiffe.io/ [2] https://gitlab.com/gauntletwizard_net/kubetls https://gitlab.com/gauntletwizard_net/kubetls