3 ms·

Google happens to have a widely trusted CA they could sign the metadata server cert with

• rantwasp 5y ago
  my question is, if the CA cert needs to be rotated, how do you do this for all machines? it can be done, but it's not trivial
  • nijave 5y ago
    Presumably the machines have a mechanism for managing their CAs, (the trust store that ships with the OS). If machines aren't being updated frequently enough to get a new CA, they're badly outdated in other ways
    • rantwasp 5y ago
      oh yeah? and how do you update the machines/CAs?
      • nijave 5y ago
        Using the package manager like people have been doing for years. Keeping OS CAs updated is a long solved problem