Hacker News new | ask | show | jobs
by ixtli 3077 days ago
Personally I've always used x509 client certs with a self signed root authority / intermediate authority for internal tooling at companies i've worked for. This is possible because 1) i happen to already have a good understanding of openssl and how to use it, secure keys 2) i have control over the devices im provisioning so i can make them trust my root cert for timing/x509/etc.

It would be really cool if there was a service like letsyncrypt that would provision "client" certs for this sort of use but revocation lists and things are a little annoying for large scale use.

EDIT: Another reason why this can be a hassle is that while Safari/IE/Chrome use the system to evaluate trusted certs on all OSs i've tested, firefox uses its own implementation so you have to add all the certs yourself. This is ... frustrating from a management perspective because you have to keep two sets of docs explaining what to do for new hires and etc.

EDIT 2: I've always been curious if its a net security benefit that firefox does this. On one hand, they are less vulnerable to OS-specific attacks and can automatically un-trust root certs that are compromised for whatever reason, but you're then trusting Mozillas implementation of something that is admittedly very complex.
2 comments
newscracker 3077 days ago
In Firefox, there's a configuration setting (from about:config) in Windows (not sure about other OSes) that can be used to tell Firefox to use the system certificate store for root CAs. There are also deployment mechanisms where this can be pushed as one of the default policies. [1]

The Firefox Enterprise mailing list is the place to go to for deeper level help on these things. [2]

[1]: https://wiki.mozilla.org/CA:AddRootToFirefox

[2]: https://mail.mozilla.org/listinfo/enterprise

link
ixtli 3077 days ago
Thank you! It's always just been a passing annoyance so I never bothered to look into it, but TIL.
link
jhanschoo 3077 days ago
Considering that mozilla is one of the founding members of Let's Encrypt, I think and hope that they are pretty competent in PKI.
link
ixtli 3077 days ago
Heh you make a good point.
link