teddypolice

joined 1 week ago
sorted by: new top controversial old
deepseek in c/microblogmemes@lemmy.world
[–] teddypolice@feddit.org 2 points 2 days ago

I mean I'm not saying the investment isn't emotional only.

deepseek in c/microblogmemes@lemmy.world
[–] teddypolice@feddit.org 7 points 2 days ago (2 children)

Because they need to protect their investment bubble. If that bursts before Deepseek is banned, a few people are going to lose a lot of money, and they sure as heck aren't gonna pay for it themselves.

Recommendations: Internal Certificate Authority w/ CRL and/or OCSP in c/selfhosted@lemmy.world
[–] teddypolice@feddit.org 1 points 5 days ago

I'm a trained netsec professional so handling keys and such is not really a hassle for me. What is a hassle IMO is having to manually do more things than hitting the "revoke" button to fully properly revoke a certificate, so that's where the CRL/OCSP req comes from.

Looks like that part is something you really only get for free with EJBCA, which I've tried and found very exhausting to use for my home network. If I had to pick one for work I'd probably go with EJBCA though, seems worth the effort if you're doing more complex things.

Recommendations: Internal Certificate Authority w/ CRL and/or OCSP in c/selfhosted@lemmy.world
[–] teddypolice@feddit.org 1 points 5 days ago* (last edited 5 days ago)

step-ca does not currently support active revocation mechanisms like a Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP).

Meh. Doesn't do what I need it to. :/

Does seem like automatic CRL/OCSP is something you only get for free with EJBCA. Frustrating, that.

20
Recommendations: Internal Certificate Authority w/ CRL and/or OCSP (feddit.org)
 

Title says it - I want a simple CA that doesn't overcomplicate things (looking at you, EJBCA). I need it to serve at least CRLs or better OCSP automatically for the certs it manages. If it comes with a Web GUI, all the better, but doesn't need to. Docker deployment would be sweet.

Currently handling this on an OPNSense I happen to be running, but that thing is also serving stuff to the public 'net, so I'd rather not have my crown jewels on there.