4 ms·

my question is, if the CA cert needs to be rotated, how do you do this for all machines? it can be done, but it's not trivial

• nijave 5y ago
  Presumably the machines have a mechanism for managing their CAs, (the trust store that ships with the OS). If machines aren't being updated frequently enough to get a new CA, they're badly outdated in other ways
  • rantwasp 5y ago
    oh yeah? and how do you update the machines/CAs?
    • nijave 5y ago
      Using the package manager like people have been doing for years. Keeping OS CAs updated is a long solved problem