You Like It Or Not; You Need It! - PKI And Certificate Management
Talkat KubeCon + CloudNativeCon North America 2022 · on Friday, 2022-10-28· at 14:55· Virtual Platform Only·
summary
Argues that PKI is essential for microservices and service mesh and shows a working OpenSSL demo that builds a root and intermediate CAs and signs leaf certs, plus certificate file formats and CSRs. Recommends using Spiffe/Spire to mint and auto-rotate SVIDs so workloads don’t need manual cert churn, and lists five concrete design decisions: certificate hierarchy, where to terminate TLS (proxy vs compute), TLS vs mTLS coexistence, certificate revocation list/OCSP design, and automation plus monitoring (mentions AWS Certificate Manager, Let’s Encrypt, Digicert, Grafana).
AI-written summary · about
chapters (13)
- 0:00Intro
- 1:29Public Key Infrastructure (PKI)
- 6:38Cryptography - Public & Private Key
- 8:08Digital Certificates
- 10:07Sample Certificate
- 11:37Certificate Encoding and Files
- 13:22Certificate Hierarchy (Chain)
- 19:41Case Study - Steps and Tools to Setup
- 28:56Design (or Know) your certificates chain and hierarchy
- 30:07Where to terminate your certificates?
- 31:27TLS version mis-matches & design decision
- 32:39Certificate Revocation Methods & Design
- 34:16Certificate Automation and Monitoring
related talks
31mPractical TLS Advice for Large Infrastructure
56mIoT: Taking PKI Where No PKI Has Gone Before
06mIgnite: Monitoring and maintaining self-signed certificates is dangerous
40mDigital Identities - 21 PKI Pitfalls and How Best to Avoid Them
49mHerding Certs - How to Automate Certificate Management
14mAutomated (PKI) Infrastructure: The AI You Should Be Thinking About
27mAddressing the growing threat of non-human identities with PKI
28mService Identity - The Key to Zero Trust with Service Mesh