4 ms·
Exactly. This is really useful in larger organizations where you may want more complex rules on access. For example, you can easily build "break glass" or 2nd
by lokar 7mo ago
Exactly. This is really useful in larger organizations where you may want more complex rules on access. For example, you can easily build "break glass" or 2nd party approved access on demand. You can put whatever logic you need in a CA front-end.
You can also make all the certs short-lived (and only store them in ram).
- TZubiri 7mo agoThe way I've been doing that is with Shamir Secret Sharing and encrypting keys until glass-breaking is necessary.
- lokar 7mo agogenerating tons of keys? or just broad keys? What I've done is generate a cert for the host(s) the user needs, for the time-span they need (subject to authorization logic).