Survey for Certificate Management Needs

[Michael Richardson]

Richard Hanley <rhanley at google.com> wrote:
    > I think that CRL becomes more of an issue when communication is
    > mutually authenticated.  If a client is given a certificate from the
    > CA, then there should be a way for that client's cert to be revoked on
    > a BMC.

Again, it's the CA that issues the CRL.
If you want to revoke authorization, then you need to do that.
I'm unware of client-certificate based authorization in bmcweb at this time.

If your authorization process if just "signed by CA foo"
(i.e. authentication), then you would have to rely on the CA to revoke the
certificate.

If your authorization process consists of a list of pinned EE certificates,
then you could delete/mark-inactive the broken certificate.

If you combine both methods, then in theory, you could have a "anything
signed by CA foo, unless it is on blacklist X".  But that's not a CRL, that's
a blacklist.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     mcr at sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 487 bytes
Desc: not available
URL: <http://lists.ozlabs.org/pipermail/openbmc/attachments/20200504/fb0c3f78/attachment-0001.sig>