today's howtos
-
An (Open)SSH Certificate Authority is sort of unlimited and sort of not
One critical difference between OpenSSH cert-authorities and TLS CAs is what you trust. In TLS, you trust a specific self-signed X.509 certificate, and the certificate is identified by its X.509 Subject Name plus (in effect) its public key. As covered in sshd(8)'s section on the authorized keys file format and the known-hosts format, OpenSSH cert-authorities are identified by their public key, and this is all of the cert-authority provided information that you have to use. So unlike TLS CAs, an OpenSSH cert-authority can't generate a 'CA' that can intrinsically only be used to sign things under a certain domain.
-
TLS CA root certificate name constraints for internal CAs
For a long time, one of the pieces of advice for dealing with various TLS certificate problems is that you should establish your own internal Certificate Authority with its own CA root certificate, have your systems trust it, and then issue certificates from your internal CA with whatever names and other qualities you needed. My reaction to this suggestion has traditionally been that it was extremely dangerous. If your internal CA was compromised in some way you had given an attacker the ability to impersonate anything, and generally properly operating a truly secure internal CA is within neither the skills nor the budget of a typical organization or group (it's certainly not within ours). Fortunately, this issue was obvious to a lot of people for a long time, so as part of RFC 5280 we got name constraints, which restricted the names (in most contexts, the DNS names) that the CA could sign certificates for. You could include only some (sub)domains, or exclude some.
-
idroot
-
How To Install Next.js on AlmaLinux 9
In this tutorial, we will show you how to install Next.js on AlmaLinux 9. Next.js, a popular React framework, offers a powerful toolkit for building web applications. AlmaLinux 9, known for its security and reliability, is an excellent choice for hosting your Next.js projects.
-
How To Install Kotlin on Ubuntu 22.04 LTS
In this tutorial, we will show you how to install Kotlin on Ubuntu 22.04 LTS. Kotlin has swiftly risen to prominence as a modern programming language that offers enhanced expressiveness, conciseness, and safety, making it a popular choice for various software projects.
-