Survey for Certificate Management Needs

[Richard Hanley]

On Mon, May 4, 2020 at 5:20 PM Michael Richardson <mcr at sandelman.ca> wrote:

>
> Richard Hanley <rhanley at google.com> wrote:
>     > I think that CRL becomes more of an issue when communication is
>     > mutually authenticated.  If a client is given a certificate from the
>     > CA, then there should be a way for that client's cert to be revoked
> on
>     > a BMC.
>
> Again, it's the CA that issues the CRL.
> If you want to revoke authorization, then you need to do that.
> I'm unware of client-certificate based authorization in bmcweb at this
> time.
>

There is some support for it in bmcweb. Intel added it at the beginning of
the year.  We've just started looking into it, so I don't have a great idea
of what is and isn't implemented yet.


>
> If your authorization process if just "signed by CA foo"
> (i.e. authentication), then you would have to rely on the CA to revoke the
> certificate.
>
> If your authorization process consists of a list of pinned EE certificates,
> then you could delete/mark-inactive the broken certificate.
>
> If you combine both methods, then in theory, you could have a "anything
> signed by CA foo, unless it is on blacklist X".  But that's not a CRL,
> that's
> a blacklist.
>
>
Perhaps I mispoke here, but let's imagine a situation where a machine is
suspected to have been tampered with.  In that case the machine could be
re-imaged and have the CA sign a new cert with the same username.  The CA
would then need to deploy the CRL to any servers (BMCs in this case) that
interacted with that user. In practice (for us at least), that CA doesn't
really know what users are authorized where, so the CRL is widely
distributed.

That's also one of the reasons I like RBAC, and other systems like it. They
do a really good job at cleanly separating authorization and
authentication.

> --
> ]               Never tell me the odds!                 | ipv6 mesh
> networks [
> ]   Michael Richardson, Sandelman Software Works        |    IoT
> architect   [
> ]     mcr at sandelman.ca  http://www.sandelman.ca/        |   ruby on
> rails    [
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ozlabs.org/pipermail/openbmc/attachments/20200504/c255d528/attachment.htm>