3 ms·

Regarding #1, check out Anchor - https://wiki.openstack.org/wiki/Security/Projects/Anchor https://wiki.openstack.org/wiki/Security/Projects/Anchor - an ephemera

by chair6 11y ago

Regarding #1, check out Anchor - https://wiki.openstack.org/wiki/Security/Projects/Anchor https://wiki.openstack.org/wiki/Security/Projects/Anchor - an ephemeral PKI system coming out of the OpenStack community. In brief, it attempts to address weaknesses in PKI operations and specifically revocation capabilities by allowing issuance of short-lived certificates based on a set of validation rules. The README has some detail about the tool, http://git.openstack.org/cgit/stackforge/anchor/tree/README.md http://git.openstack.org/cgit/stackforge/anchor/tree/README..... A recent presentation is at https://www.youtube.com/watch?v=Q_ZhrQq-_YM https://www.youtube.com/watch?v=Q_ZhrQq-_YM.

viraptor 11y ago
Just in case the stackforge link disappears, the project is being moved right now into OpenStack proper. There's no dependency though, so you can easily use it on its own. We'll release version 1 soon, so the API will change just a little bit, but the main idea remains: issuing short lived certificates from a single location (or multiple, it works without changes in multi master mode). If you have any configuration issues, get in touch, we're happy to hear about new use cases for this tool.
- mugsie 11y ago
  There is still the issue of the CA that is in place for anchor - your users have to trust it.
  - viraptor 11y ago
    Yes, the main reason it was created is OpenStack deployments where Anchor is used for securing internal communications, so the PKI is an internal one (most likely). We cannot change how the CAs work in public networks unfortunately, but if they do, we're going to be ready :)