Hacker News Reader

Comment by mikegioia | Hacker News Reader

Our development server at work is authenticated using client-side certificates that I install on every employee's computer (along with our Root CA cert). This takes me about 5 minutes to generate for them [1] and another 2 minutes to put into their OSX keychain. It's fun to sit there with each person and show them what I'm doing and how this wonderful system works.

But if I asked ANY ONE of them to do ANY step along the way, they'd throw their hands up and quit. My brother who is extremely tech competent can't do this. I like these suggestions but I just don't know fundamentally if this system can be used by people without a drastic overhaul to the UI.

[1] https://github.com/TeachBoost/pki

View on HN

You might also like cloudflare's cfssl toolsuite: https://github.com/cloudflare/cfssl

I've reduced most of my cert-generating to just a one-liner and a JSON metadata file. For example: https://twitter.com/shazow/status/582262725683777536

Wow, thanks for that link. That's an awesome set of tools.

It's even hard for those trying to understand it (I'll speak for myself coming from a non-CS background), and that's not even the same battle as implementing all the separate parts in an efficient way day to day. I've worked on my own bash cli tool[1] for more efficient openssl usage and mentioned it here before.[2] Only after that project was I able to finally understand the concepts enough to use the thing at all.

[1]https://github.com/brianclements/pkictl

[2]https://news.ycombinator.com/item?id=10257074

It's kind of a pain, but I wonder if you could, in whatever level of detail you would like to provide, walk us through the steps you take, especially the more 'throw their hands up and quit' ones.

If you don't want to, I totally understand!

I absolutely can. I know that project I listed has 0 documentation, but I should rip out the code and move it to another repo with a README.

The short of it is that I run the following. (I know this repo has our public keys, but if you clone it you can totally run this as well to see what's going on).

    ./bin/root-ca.sh
    ./bin/tls-ca.sh
    ./bin/client.sh

The first command will create the Root Certificate Authority in your tiered system. The second one will create a TLS Certificate Authority underneath the Root. This TLS CA is for issuing certificates (like browser client certificates, or email S/MIME certificates). Finally, the last script will walk you through creating one of these client certs.

The client.sh script will generate a .p12 file that you can import into Keychain or your browser's certificate store. The only other step is to import the Root certificate (mine is TeachBoostRootCA.crt in the ca folder) into Keychain and/or your browser.

If you're curious, take a look at the config file in the top level directory. This has all of the naming conventions my repo uses but if you clone this, clear the 'ca', 'certs', and 'crl' folders, then you can have free reign on running your own Certificate Authority. The scripts will walk you through everything but if you have any questions don't hesitate to open a GH issue on that repo and I'll get back to you there.

Thanks! I will take a peek at it.

This is my observation as well. Smart people, e.g. people with PhDs or working on them, just by and large do not understand key pairs. They have terrible trouble with ssh keys, and I am sure would have as much or more trouble with client certificates.

It has to be something that is totally automated, and can't rely on copying or uploading or in any way touching public keys as a manual step.

Doesn't Diffe-Hellman allow to generate a key pair without manual intervention?

Reply on news.ycombinator.com