2 ms·
> Dealing with SSL certificate management could be an operational pain in the neck. I don't know for WireGuard but generating the certificate for a new host to
by hamdouni 4y ago
> Dealing with SSL certificate management could be an operational pain in the neck.
I don't know for WireGuard but generating the certificate for a new host to join the mesh in Nebula is one command
nebula-cert sign -name "newHost" -ip "192.168.100.1/24"
- metadat 4y agoDo the certs expire? What does the rotation process involve?
- hamdouni 4y agonope - no expiration, no rotation needed : this is all about mutually authenticated peer-to-peer nodes
- psanford 4y agoYes certs expire (expiration is configurable). Large deployments will run an online CA that has some external means of verifying the identity of a host. Rotation is straight forward. Add the new cert and reload the process (no restart required). Large deployments automate this process (which is easy with an online CA).