3 ms·

Certificates seem to be lots of work and complexity, and lots of do-it-yourself. Couldn't that functionality come as part of the OS? It is fundamental that com

Certificates seem to be lots of work and complexity, and lots of do-it-yourself. Couldn't that functionality come as part of the OS? It is fundamental that computers should be able to know whom to trust and whom not.

_8j50 4y ago
It is in windows, the cert store comes with windows and you use for many applications from code signing, email signing, server cert signing to authenticating users and the computer to the network/AD. PKI is the way windows and the corporate world went. On nix you have PGP, with GPG it is sort of baked in I guess but it is used only in package signing and signing of text content in various contexts. I believe the "web of trust" is preferred over PKI but nix folks because they don't want to depend on certificate authorities mediating trust, instead you have key servers that only help in distributing keys. For *nix, the burden of forming trust is on the user. You have to either go to key signing parties (very scalable lol) or I guess google around and ask in chatrooms and look up trustworthy sites until you are confident a key us trustworthy? I mean you can cross-sign and all that but in reality, you have to investigate each key one by one and hope you don't screw up. Or what happens in most cases is people trusr https/PKI so key IDs on people's websites or a command asking you to import a key from their site over https is trusted... because PKI/TLS is much more practical. Get the GPG fans to like PKI and maybe Linux will have PKI cert management out of the box. The Linux kernel does support X509 and pki certs afaik, I don't know if you can make it store root certs and have it verify cert chains for you from userspace. Very possible but only applications using kTLS might want that. Perhaps a feature request with your favorite browsers and package managers to use kTLS instead of openssl/gnutls is a start?
- jiggawatts 4y ago
  I suspect there isn't a Windows Enterprise PKI team any more as such, development seems to have stalled around 2016. There is no ACME support built-in either as a client or server, which is sad considering Windows already has dynamic DNS capabilities. Even Azure Key Vault won't integrate with Microsoft Enterprise PKI, which should tell you everything you need to know...
  - _8j50 4y ago
    On prem AD itself is going away, no idea if AAD has or will have a PKI component.

_8j50 4y ago

It is in windows, the cert store comes with windows and you use for many applications from code signing, email signing, server cert signing to authenticating users and the computer to the network/AD. PKI is the way windows and the corporate world went. On nix you have PGP, with GPG it is sort of baked in I guess but it is used only in package signing and signing of text content in various contexts. I believe the "web of trust" is preferred over PKI but nix folks because they don't want to depend on certificate authorities mediating trust, instead you have key servers that only help in distributing keys. For *nix, the burden of forming trust is on the user. You have to either go to key signing parties (very scalable lol) or I guess google around and ask in chatrooms and look up trustworthy sites until you are confident a key us trustworthy? I mean you can cross-sign and all that but in reality, you have to investigate each key one by one and hope you don't screw up. Or what happens in most cases is people trusr https/PKI so key IDs on people's websites or a command asking you to import a key from their site over https is trusted... because PKI/TLS is much more practical. Get the GPG fans to like PKI and maybe Linux will have PKI cert management out of the box. The Linux kernel does support X509 and pki certs afaik, I don't know if you can make it store root certs and have it verify cert chains for you from userspace. Very possible but only applications using kTLS might want that. Perhaps a feature request with your favorite browsers and package managers to use kTLS instead of openssl/gnutls is a start?

jiggawatts 4y ago
I suspect there isn't a Windows Enterprise PKI team any more as such, development seems to have stalled around 2016. There is no ACME support built-in either as a client or server, which is sad considering Windows already has dynamic DNS capabilities. Even Azure Key Vault won't integrate with Microsoft Enterprise PKI, which should tell you everything you need to know...
- _8j50 4y ago
  On prem AD itself is going away, no idea if AAD has or will have a PKI component.