https://raymii.org/s/tags/private-key.xml RSS feed for tag private-key on Raymii.org https://raymii.org/s/tutorials/nameConstraints_on_your_Self_Signed_Root_CA_in_Kubernetes_with_cert_manager.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/nameConstraints_on_your_Self_Signed_Root_CA_in_Kubernetes_with_cert_manager.html If you have [set up a Self Signed Root CA](/s/tutorials/Self_signed_Root_CA_in_Kubernetes_with_k3s_cert-manager_and_traefik.html) for your local Kubernetes Cluster and have trusted the Root Certificate, you are at risk if the key is compromised. If the key is stolen, it can be used to create trusted certificates for everything. Luckily there is something we can do, using `nameConstraints` to limit the scope of the Root Certificate to, in our case, a single domain (`k3s.homelab.mydomain.org`). This means that if your key would be compromised, it would only be able to issue certificates for anything under that domain, not your bank for example. Wed, 17 Jul 2024 23:22:00 GMT Wed, 17 Jul 2024 23:22:00 GMT https://raymii.org/s/tutorials/Self_signed_Root_CA_in_Kubernetes_with_k3s_cert-manager_and_traefik.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/tutorials/Self_signed_Root_CA_in_Kubernetes_with_k3s_cert-manager_and_traefik.html Now that I'm learning Kubernetes for a few weeks, I'm finally at the point where I was 20 years ago with regular boring old tech, being able to [host multiple domains](/s/tutorials/Kubernetes_k3s_Ingress_for_different_domains_like_virtual_hosts.html), [password protection](/s/tutorials/Password_protect_web_services_in_Kubernetes_k3s_traefik_with_basic_auth.html) and [high available clusters](/s/tutorials/High_Available_k3s_kubernetes_cluster_with_keepalived_galera_and_longhorn.html). It seems we have to re-invent the wheel every time but in the end, it's just resume-driven development, the underlying stack costs more, is way more complex but for the user, nothing changes, they see the same website as always. [Not all change is progress](https://luddites.latenightlinux.com/). Enough of being a curmudgeon, time to continue with Kubernetes. In this episode of 'Remy discovers Kubernetes', I'm setting up `cert-manager`, **not with Lets Encrypt**, but with a self-signed certificate authority. I'll also show you how to set up a regular certificate, one you've for example bought somewhere. I'll also cover `nameConstraints` to make the risk of compromise of your trusted root ca lower. Wed, 17 Jul 2024 04:22:00 GMT Wed, 17 Jul 2024 04:22:00 GMT https://raymii.org/s/snippets/OpenSSL_get_entire_certificate_chain_from_a_domain_or_use_all_certs_in_a_file.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/snippets/OpenSSL_get_entire_certificate_chain_from_a_domain_or_use_all_certs_in_a_file.html The `openssl x509` command can be used to get information from a certificate. If you supply a filename, the command will only use the topmost certificate in the file, not all certificates in the file, like in the case of a certificate chain. The `openssl s_client -connect` command can connect to a server and show all certificates served by that server. The command I'm providing in this snippet splits up all certificates found in a file or as the result of `openssl s_client` and allows `openssl x509` to loop over each one individually. Tue, 16 Jul 2024 18:30:00 GMT Tue, 16 Jul 2024 18:30:00 GMT https://raymii.org/s/snippets/OpenSSL_One_line_to_create_self_signed_certificate.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/snippets/OpenSSL_One_line_to_create_self_signed_certificate.html This is a one-liner for OpenSSL to generate a self signed certificate and private key. Wed, 09 Oct 2013 00:00:00 GMT Wed, 09 Oct 2013 00:00:00 GMT https://raymii.org/s/snippets/OpenSSL_generate_CSR_non-interactive.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/snippets/OpenSSL_generate_CSR_non-interactive.html This is a short command to generate a CSR (certificate signing request) with openssl without being prompted for the values which go in the certificate's Subject field. Sat, 09 Feb 2013 00:00:00 GMT Sat, 09 Feb 2013 00:00:00 GMT https://raymii.org/s/snippets/OpenSSL_match_certificate_with_private_key.html?utm_medium=rss&utm_source=raymii&utm_campaign=tagrss https://raymii.org/s/snippets/OpenSSL_match_certificate_with_private_key.html This check lets you know if a certificate matches a private key. Today I had to set up something but I kept getting ssl errors. Turns out, the certificate did not match the private key, because the private key file was damaged. This is how I found out. Sat, 09 Feb 2013 00:00:00 GMT Sat, 09 Feb 2013 00:00:00 GMT