Digital Identities - 21 PKI Pitfalls and How Best to Avoid Them
summary
Lists 21 concrete PKI mistakes and fixes, with examples like RSA 2048 and ECC 256 as current key standards, and incidents (O2, Equifax) tied to expired certificates. Covers weak keys, overly long lifetimes, hard‑coded public keys in apps, reuse and wildcard risks, proliferation of private CAs (including Kubernetes clusters and legacy Microsoft CAs), poor key storage versus HSM/TPM options, the need for certificate automation, discovery tools, and a push toward quantum‑safe certificates and hybrid migration paths.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 0:37aktigo
- 1:45Weak Keys
- 6:28Certificate S stapling
- 8:11Certificate reuse
- 12:05Wildcards
- 16:17Multiple CAs
- 18:35Microsoft CA
- 20:36Security Problems
- 22:43Patch Management
- 24:10No Rules
- 25:49Is there a CPS
- 26:50Revocation checking
- 27:44Public Private Certs
- 30:14Visibility
- 32:31Rogue CAs
- 33:56Future of PKI
- 36:12Crypto is Changing
- 37:19What to Do Now
- 38:08Outro
related talks
38mPKI deployments are as unique as any snowflake; how to build equally flexible PQ migration strategie
56mIoT: Taking PKI Where No PKI Has Gone Before
27mAddressing the growing threat of non-human identities with PKI
50mThe Many Faces of Identity
36mYou Like It Or Not; You Need It! - PKI And Certificate Management
16mPKI problem: who we actually trust
24mPKI Agility and the Difference to Cryptographic Agility: Lessons from the Past and Present
32mand Signatures – no Problem?