Thank you. Could you explain a bit more about your setup and the aspects I should be looking at? Specifically:
- Certificate chain of trust: I assume you’re talking about PKI infrastructure and using root CAs + Derivative CAs? If yes, then I must note that I’m not planning to run derivative CAs because it’s just for my lab and I don’t need that much of infrastructure.
- I have yet to figure out the CRL part with OpenSSL, I’ll have to read more about it. Thanks.
- I do not know what X.509 extensions are and why I need them. Could you tell me more?
- I’m also considering client certificates as an alternative to SSO, am I right in considering them this way? I will also have to think about what I could do what clients without a client certificate or my root CA’s certificate in their certificate store (maybe run another instance which doesn’t need all of the encryption and setup I’m doing and somehow redirect such clients there whilst logging their traffic?).
Thanks for the mention, I was looking at a script to automate certificate generation and revocation too.
Since we’re talking about reverse-proxies, I’ll mention that I plan to run an instance of HAProxy per podman pod so that I terminate my encrypted traffic inside the pod and exclusively route unencrypted traffic through local host inside the pod. I’m doing this because I do not want to see any unencrypted traffic in my network. Of course, this is some more overhead but I think this is doable. I got this idea from another post I made a while back. Of course, that means that every pod on my network (hosting an HAProxy instance) will be given a distinct subdomain, and I will be producing certificates for specific subdomains, instead of using a wildcard.
Thanks, I’ll be sure to document my progress as I go.
NeoNachtwaechter@lemmy.world 6 months ago
I’m curious, what’s the reason?
jdrch@lemmy.world 6 months ago
In many architectures in which certificates are used, a client with a valid certificate is a trusted client, so a certificate falling into the wrong hands is problematic.