4 ms·
If anyone wants their own HSM, Nitrokey and Yubikey sell them: * https://shop.nitrokey.com/shop/nkhs2-nitrokey-hsm-2-7 https://shop.nitrokey.com/shop/nkhs2-nit
by throw0101d 2y ago
If anyone wants their own HSM, Nitrokey and Yubikey sell them:
* https://shop.nitrokey.com/shop/nkhs2-nitrokey-hsm-2-7 https://shop.nitrokey.com/shop/nkhs2-nitrokey-hsm-2-7
* https://www.yubico.com/product/yubihsm-2-series/yubihsm-2/ https://www.yubico.com/product/yubihsm-2-series/yubihsm-2/
Consider buying two to have backups ((encrypted) export/import-backup/restore is supported).
Creating your own CA:
* https://docs.nitrokey.com/hsm/mac/certificate-authority https://docs.nitrokey.com/hsm/mac/certificate-authority
Considering using 'helper software' for running a CA:
* https://github.com/smallstep https://github.com/smallstep / https://smallstep.com/docs/step-ca/ https://smallstep.com/docs/step-ca/
* https://github.com/OpenVPN/easy-rsa https://github.com/OpenVPN/easy-rsa
* https://hohnstaedt.de/xca/ https://hohnstaedt.de/xca/
* https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert (good for on-one-host dev stuff)
- RobotToaster 2y agoDo you know where I can find the source for the nitrokey HSM 2 hardware? It claims to be OSH but I can't find the schematics on their github? (Probably I've just overlooked it, they have a lot of repos)
- throw0101d 2y ago* https://www.nitrokey.com/products/nethsm https://www.nitrokey.com/products/nethsm / https://github.com/Nitrokey/nethsm/ https://github.com/Nitrokey/nethsm/ * https://security.stackexchange.com/questions/246547/open-source-hardware-security-modules-hsm https://security.stackexchange.com/questions/246547/open-sou...
- madduci 2y agoAlso worth mentioning EJBCA from PrimeKey. They also sell their own HSM appliance
- throw0101d 2y ago> They also sell their own HSM appliance Lots of folks sell appliances, but if you want to homelab, DIY, or do a small-scale deployment then the above items are simply USB keys so that be put into any server (or VM, via pass-through).
- ThePowerOfFuet 2y agoIf @dang wouldn't hand me my arse, I'd be tempted to create accounts to upvote this multiple times. If you want to save some cash, get the Smartcard-HSM; the Nitrokey HSM is exactly that inside a different housing. https://www.smartcard-hsm.com/features.html https://www.smartcard-hsm.com/features.html Don't trust software with secrets.
- nonrandomstring 2y agoA very helpful and practical reply, thank you. Good to see how this getting more practical for everyone. Sure, there are 'issues' with HSMs, but in general they make for better security for operators that fully control them in the ways you've shown how.
- coretx 2y ago* https://www.nordicsemi.com/Products/Development-hardware/nRF52840-Dongle https://www.nordicsemi.com/Products/Development-hardware/nRF... Only 10 bucks and can run OpenSK/Tock, FIDO2 code, among other things. This way you save money and learn something.