It’s pretty simple to set up. Generate CA, keep key and other private stuff stored securely, distribute public part of CA to whoever you want and sign all the things you wish with your very own CA. There’s loads of howtos and tools around to accomplish that. The tricky part is that manual work is needed to add that CA to every device you want to trust your certificates.
Comment on Decreasing Certificate Lifetimes to 45 Days
Valmond@lemmy.world 5 weeks agoBut you have to manually accept this dangerous cert in the browser right?
Very interesting actually, do you have any experience about it or other pointers? I might just set one up myself for my tenfingers sharing protocol…
IsoKiero@sopuli.xyz 5 weeks ago
Valmond@lemmy.world 5 weeks ago
Thank you! This is actually precisely what I need, you IT guys are the best!
helios@social.ggbox.fr 5 weeks ago
No that’s the point. If you import the CA certificate on your browser, any website that uses a cert that was signed by that CA will be trusted and accessible without warning.
Unforeseen@sh.itjust.works 5 weeks ago
Valmond@lemmy.world 5 weeks ago
Thank you!
Is there some simple soft that let you make those certs, like with a root cert and then “derived” certs? On linux :-) ?
I guess people have to re-trust every now and then because certs get old, or do they trust the (public partof the) root cert and the daughter certs derived from root are churned out regularly for the sites?
Unforeseen@sh.itjust.works 5 weeks ago
Valmond@lemmy.world 5 weeks ago
I was forced to learn some of it at work (using and signing medical payment transactions, with x509 certificates) so I have ar least a starting point. I have no idea how the revoke process works though, I can’t figure out a way that it functions without a central authority getting queried regularly. I thonk I can start without that knowledge though.
Anyway, with your information I’m up and running, thank you again!
“Derived certificates” not child certs, noted !