4 ms·
HashiCorp Vault supports being an ACME server. Why not use that?
by firesteelrain 3y ago
HashiCorp Vault supports being an ACME server. Why not use that?
- rigrassm 3y agoTo be fair, this was only introduced in the most recent major version release not too long ago. But I agree, it's a great feature and worked as advertised after following their guide. Doesn't sound like a ringing endorsement but in my experience it's rare for custom CA tooling to Just Work and until now none of them resulted in a fully functional ACME provider to serve up your certs.
- firesteelrain 3y agoI agree. I just set it up the other day in a container. It’s going to be our ACME provider. It is stupid easy
- wejn 3y agoBecause: 1. ACME is a dumpster fire prone to mitm attacks. 2. without HSM (an additional investment) it's super bad idea to host your root CA signing key somewhere.
- firesteelrain 3y agoThis is an internal, airgapped network. We stood up the root CA, created the certificate, imported it, then destroyed the root CA. It’s a common security practice. Root CA can then never be compromised
- wejn 3y agoIf you destroy the CA, how do you issue new certs via ACME?
- firesteelrain 3y agoSub CAs or Intermediate CA The root CA certificate is used to establish trust in the chain of trust, but it is not directly involved in the certificate issuance process once the trust has been established.