John-Mark Gurney wrote on 2020/03/20 20:29:
Rick Macklem wrote this message on Thu, Mar 19, 2020 at 23:41 +0000:
[...]
Without a problem statement or what you're trying to accomplish, it's
hard to say if it is.
The problem I was/am trying to solve was a way for NFS clients without a
fixed IP/DNS name could have a certificate to allow access to the NFS server.
As suggested by others, having a site local CA created by the NFS admin. seemed
Yes, I totally agree w/ this as the best solution. It also allows
private hostnames to be used w/o leaking outside the org..
It'd be nice to have better tooling around the CA though. I still
haven't found any good tools that make a CA simple to use for small
installs... (and by simple, I mean single init command, and single
command to issue a cert or generate a key/cert pair, all of them are
like, make all thesse directories, edit these files, and run these
comlicated commands)
security/easy-rsa is very close to this.
# easyrsa init-pki
# easyrsa build-ca
# easyrsa build-server-full <your_server>
# easyrsa build-client-full <client_name1>
# easyrsa build-client-full <client_name2>
# easyrsa build-client-full <client_nameN>
or
# easyrsa build-client-full <client_nameN> nopass
And usually
# easyrsa gen-dh
With "build-ca" you will create key and certificate for you private CA
With "build-server-full" you will create key and certificate for your server
With "build-client-full" you will create key and certificate for clients
It also supports "revoke" and "gen-crl" to revoke compromised
certificate and update CRL.
Yes, it could be made a bit simpler and run init-pki in the background
if build-ca is run for the first time so you can save one step.
I don't say easy-rsa is the best choice. I am able to use full openssl
commands or write my own tools / scripts around it I choose easy-rsa on
machines where somebody else needs to work with certs.
[...]
Kind regards
Miroslav Lachman
_______________________________________________
freebsd-current@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"
