3 ms·

Ok lets spin up the ca and create a cert for this service. Validity 15 years. <15 years later> Why did this thingy break? How do I get a new cert? CA was on a

Ok lets spin up the ca and create a cert for this service. Validity 15 years. <15 years later> Why did this thingy break? How do I get a new cert? CA was on a Virtul Machine? The old server? What is ESXi? Ok we will just spin up this docker container, create a new cert and make it last 20 years...

bravetraveler 4y ago
I'm not doubting it can be done poorly I'm just curious why an org would do that when they have a domain controller/login infrastructure providing a CA, or one of the many secret-storing-engines backing the vast majority of their sensitive data (eg: Vault)? Policies can be defined and enforced to serve as guard rails -- we choose the nightmares we accept
- zaphar 4y ago
  Ahhh, yes I see where you got lost. You are assuming that they either: * Have a team willing to commit to managing CAs as part of the DC/Login infrastructure. or * Are actually using something like Vault in their infrastructure. Common mistake, really. In all seriousness you would be amazed how many places neither of those things are true for, and additionally how much sheer effort it would take to make them true at those orgs.
  - 0xbadcafebee 4y ago
    If you have a team that manages a domain, it will take a month to get anything done with them, if they even allow you to get what you need done. If there is a way to make it easier, they aren't interested.
    - bravetraveler 4y ago
      Instead we get to deal with finance for two months to order from a public CA! Before anyone says it, yes we know about LetsEncrypt, and no we cannot use it
  - bravetraveler 4y ago
    Indeed, I am a bit spoiled... I neglected smaller shops where 'not enough people' rings even more true. Where I'm at, we have tons and tons of people, enough to dedicate (and form) teams for things. It admittedly skews my view quite a bit. Here... we don't have enough capable people. I'm also a bit sour at the alternatives. We have certain (publicly visible) certificates that must go through a CA. That's an absolutely painful process that requires about six levels of finance approval -- every year!
bombcar 4y ago
This is the main reason let’s encrypt gives you three month certs - so you setup a way of automating it. It’s not too hard but I wish it could be even easier. The best I’ve found is a main system that gets the wildcard cert and then transfers that around where needed.

bravetraveler 4y ago

I'm not doubting it can be done poorly I'm just curious why an org would do that when they have a domain controller/login infrastructure providing a CA, or one of the many secret-storing-engines backing the vast majority of their sensitive data (eg: Vault)? Policies can be defined and enforced to serve as guard rails -- we choose the nightmares we accept

zaphar 4y ago
Ahhh, yes I see where you got lost. You are assuming that they either: * Have a team willing to commit to managing CAs as part of the DC/Login infrastructure. or * Are actually using something like Vault in their infrastructure. Common mistake, really. In all seriousness you would be amazed how many places neither of those things are true for, and additionally how much sheer effort it would take to make them true at those orgs.
- 0xbadcafebee 4y ago
  If you have a team that manages a domain, it will take a month to get anything done with them, if they even allow you to get what you need done. If there is a way to make it easier, they aren't interested.
  - bravetraveler 4y ago
    Instead we get to deal with finance for two months to order from a public CA! Before anyone says it, yes we know about LetsEncrypt, and no we cannot use it
- bravetraveler 4y ago
  Indeed, I am a bit spoiled... I neglected smaller shops where 'not enough people' rings even more true. Where I'm at, we have tons and tons of people, enough to dedicate (and form) teams for things. It admittedly skews my view quite a bit. Here... we don't have enough capable people. I'm also a bit sour at the alternatives. We have certain (publicly visible) certificates that must go through a CA. That's an absolutely painful process that requires about six levels of finance approval -- every year!

bombcar 4y ago

This is the main reason let’s encrypt gives you three month certs - so you setup a way of automating it. It’s not too hard but I wish it could be even easier. The best I’ve found is a main system that gets the wildcard cert and then transfers that around where needed.