Re: Survey for Certificate Management Needs

[Michael Richardson <mcr@sandelman.ca>]

[-- Attachment #1: Type: text/plain, Size: 1149 bytes --]


Richard Hanley <rhanley@google.com> wrote:
    > I think that CRL becomes more of an issue when communication is
    > mutually authenticated.  If a client is given a certificate from the
    > CA, then there should be a way for that client's cert to be revoked on
    > a BMC.

Again, it's the CA that issues the CRL.
If you want to revoke authorization, then you need to do that.
I'm unware of client-certificate based authorization in bmcweb at this time.

If your authorization process if just "signed by CA foo"
(i.e. authentication), then you would have to rely on the CA to revoke the
certificate.

If your authorization process consists of a list of pinned EE certificates,
then you could delete/mark-inactive the broken certificate.

If you combine both methods, then in theory, you could have a "anything
signed by CA foo, unless it is on blacklist X".  But that's not a CRL, that's
a blacklist.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     mcr@sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]