Collaborate Disseminate
The Subject Public Key Info field can have a value like ECDSA_P256 or ECDH_P256 when ECC is used.
Why is it not sufficient to specify "ECC_P256"? In other words, why is it not enough to specify just the curve parameters (like pri… Continue reading Why does the Public Key Info field in an X509 certificate for EC indicate the algorithm
HashiCorp Vault Agent creates a sidecar that talks to Vault server and injects secrets as files into containers. The agent presumably uses Kubernetes Service Account in some way. But ultimately there must be a secret zero somewhere, protec… Continue reading How Vault agent solves Secret Zero challenge in Kubernetes?
In Kubernetes, I use an nginx ingress controller to do TLS termination and load balancing.
When mutual TLS is used, the ingress controller can be configured to forward the client certificate as an http field, but this information is obviou… Continue reading How to trust the Kubernetes ingress controller?
TLS requires reliable transport but is not bound to TCP. How can I perform a TLS 1.3 handshake through a non-TCP channel with OpenSSL – for example by exchanging a number of files between participating communication partners?
I have an offline safe at a remote location that I want to give people access to at my discretion. I would like to control who and when they have access, without having to travel to the safe.
Example:
I would like "Peter" to be … Continue reading Authentication to offline device
When I access https://example.com on my company’s laptop that has a X509 client certificate installed, using my home internet connection, without using a VPN, the requested page is signed using the company’s Root CA (which was distributed … Continue reading How does Cloudflare negotiate its server certificate?