Re: Cert penning, Certs and related

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On Mon, Oct 10, 2016, at 01:04 PM, Kevin Fenzi wrote:
> On Mon, 10 Oct 2016 16:57:25 +0000
> Patrick Uiterwijk <puiterwijk@xxxxxxxxxx> wrote:
> 
> ...snip...
> 
> > As far as I know, yum/dnf supports setting a cafile for repos, so we
> > can just update fedora-repos.
> 
> That doesn't help. If we are using a well known cert, it's already
> valid based on the system ca's, and IMHO it would be very poor to use a
> self signed cert for this. So, either librepo carries a static list for
> our base repos or we add support for HPKP. 

I would s/static list/custom root CA set/.

It's worth emphasizing that having a custom CA root set is
a very standard thing to do - we're basically just doing
exactly what ca-certificates does, just with a different configuration.

And it's supported today by both librepo and ostree, and many
HTTP libraries in general.  And both of those code paths are used
today for Red Hat Enterprise Linux Atomic Host, talking
to the default Akamai CDN.

HPKP is (as far as I know) mostly a browser thing[1]; it isn't
implemented by libcurl for example.  Though it does
make sense for general outside-of-the-browser use cases,
from an operating system perspective, we already have
a mechanism to ship the configuration out-of-band to
client systems by embedding it into the installation media
and the update stream.  The same as we do for GPG.

Basically, I think it's easiest if we think of the keys/configuration for
CA-pinning the same as GPG.


[1] Though I did find https://github.com/tam7t/hpkp - kind of curious
  what Digital Ocean is doing with it if anything
_______________________________________________
infrastructure mailing list -- infrastructure@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to infrastructure-leave@xxxxxxxxxxxxxxxxxxxxxxx




[Index of Archives]     [Fedora Development]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [KDE Users]

  Powered by Linux