3 ms·
We want to make the SSL setup even easier. The big hurdle is the current lack of easy to setup CA management tools. Any suggestions on tools? openssl's CA tool
by philips 13y ago
We want to make the SSL setup even easier. The big hurdle is the current lack of easy to setup CA management tools.
Any suggestions on tools? openssl's CA tools work but are pretty difficult to setup and use. It would be great if someone built a CA tools on top of the native Go x509 API.
I would love to have a discussion (or patches!) around revocation and status checking in the next version. The project is young but we want to get security right from the beginning.
- e12e 13y agoThe last time I checked, I couldn't find any projects that looked very appealing. There's (now defunct) python CA-project: http://www.pyca.de/ http://www.pyca.de/ Then there's http://www.openca.org/ http://www.openca.org/ (which I've not go any experience with), and of course plain openssl -- which I've always felt is more of a proof of concept than anything really useful. We need a simple, opinionated project, something along the lines of salt/NaCl -- and I suspect go would be a great implementation platform. The only sane option I know of, would be Microsoft AD w/CA setup -- but that's not Free, not open, and not really a good fit for this purpose either [edit: to clarify - it's much too big, and does much more than needed. I'm also not sure how well it works in a setup where you want to keep the root keys offline as much as possible].
- SEJeff 13y agohttps://fedorahosted.org/certmaster https://fedorahosted.org/certmaster It is python, but this is actually really good stuff.
- philips 13y agoThat looks interesting. I will check it out. I will collect other ideas over here: https://github.com/coreos/etcd/issues/99 https://github.com/coreos/etcd/issues/99