Harry Sintonen<p>Just spent some quality time figuring out why HTTPS requests with incorrect system time would fail - even though the time was between the certificate NotBefore and NotAfter.</p><p>OCSP stapling was the culprit. This adds a more strict "window of system time validity" due to the way the protocol works. The obvious reason for the smallish window is to allow caching, while reducing the replay attack possibilities. Thus, the system clock can't be backdated more than a few hours, regardless of certificate NotBefore. The system time can be more off towards the future.</p><p>In our use case, we don't need to worry about revocation and hence we will just kill OCSP use. With this, we will still have the limits set by the certificate NotBefore and NotAfter, but at least they're more predictable and somewhat laxer.</p><p><a href="https://infosec.exchange/tags/pki" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pki</span></a> <a href="https://infosec.exchange/tags/publickeyinfrastructure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>publickeyinfrastructure</span></a> <a href="https://infosec.exchange/tags/tls" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>tls</span></a></p>
Recent searches
No recent searches
Search options
Only available when logged in.
social.tchncs.de is one of the many independent Mastodon servers you can use to participate in the fediverse.
A friendly server from Germany – which tends to attract techy people, but welcomes everybody. This is one of the oldest Mastodon instances.
Administered by:
Server stats:
3.8Kactive users
social.tchncs.de: About · Profiles directory · Privacy policy
Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.3.7
#pki
1 post · 1 participant · 0 posts today
Preston Maness ☭<p><span class="h-card" translate="no"><a href="https://mastodon.ml/@Xeniax" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>Xeniax</span></a></span> Totally nerdsniped :D I'd love to be a part of the study.</p><p>I don't think that <a href="https://tenforward.social/tags/KeyServers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>KeyServers</span></a> are dead. I think they evolved into Verifying Key Servers (VKS), like the one run by a few folks from the OpenPGP ecosystem at <a href="https://keys.openpgp.org/about" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">keys.openpgp.org/about</span><span class="invisible"></span></a> . More generally, I believe that <a href="https://tenforward.social/tags/PGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PGP</span></a> / <a href="https://tenforward.social/tags/GPG" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>GPG</span></a> / <a href="https://tenforward.social/tags/OpenPGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OpenPGP</span></a> retains important use-cases where accountability is prioritized, as contrasted with ecosystems (like <a href="https://tenforward.social/tags/Matrix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Matrix</span></a>, <a href="https://tenforward.social/tags/SignalMessenger" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SignalMessenger</span></a>) where deniability (and Perfect Forward Secrecy generally) is prioritized. Further, PGP can still serve to bootstrap those other ecosystems by way of signature notations (see the <a href="https://tenforward.social/tags/KeyOxide" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>KeyOxide</span></a> project).</p><p>Ultimately, the needs of asynchronous and synchronous cryptographic systems are, at certain design points, mutually exclusive (in my amateur estimation, anyway). I don't think that implies that email encryption is somehow a dead-end or pointless. Email merely, by virtue of being an asynchronous protocol, cannot meaningfully offer PFS (or can it? Some smart people over at crypto.stackexchange.com seem to think there might be papers floating around that can get at it: <a href="https://crypto.stackexchange.com/questions/9268/is-asynchronous-perfect-forward-secrecy-possible" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">crypto.stackexchange.com/quest</span><span class="invisible">ions/9268/is-asynchronous-perfect-forward-secrecy-possible</span></a>).</p><p>To me, the killer feature of PGP is actually not encryption per se. It's certification, signatures, and authentication/authorization. I'm more concerned with "so-and-so definitely said/attested to this" than "i need to keep what so-and-so said strictly private/confidential forever and ever." What smaller countries like Croatia have done with <a href="https://tenforward.social/tags/PKI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PKI</span></a> leaves me green with envy.</p>
Mathis<p>Heutiger Aha-Moment: <a href="https://norden.social/tags/PGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PGP</span></a>-Key-Verteilung über die eigene <a href="https://norden.social/tags/Webseite" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Webseite</span></a>, komplett ohne zentralisierte <a href="https://norden.social/tags/Keyserver" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Keyserver</span></a> o.ä. - sehr schön! Gleich eingerichtet. ✅ <br>Macht Ihr auch mit?</p><p><a href="https://blog.mister-muffin.de/2025/03/31/til-openpgp-web-key-directory/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">blog.mister-muffin.de/2025/03/</span><span class="invisible">31/til-openpgp-web-key-directory/</span></a></p><p><a href="https://norden.social/tags/GnuPG" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>GnuPG</span></a> <a href="https://norden.social/tags/GPG" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>GPG</span></a> <a href="https://norden.social/tags/PKI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PKI</span></a></p>
Cuz :twit:<p>This is what innovation can do!</p><p><a href="https://twit.social/tags/AirGapped" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>AirGapped</span></a> <a href="https://twit.social/tags/Offline" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Offline</span></a> <a href="https://twit.social/tags/PKI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PKI</span></a> <a href="https://twit.social/tags/PrivateKeys" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PrivateKeys</span></a> <a href="https://twit.social/tags/TwoFactor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>TwoFactor</span></a>- <a href="https://twit.social/tags/2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>2FA</span></a> <a href="https://twit.social/tags/Yubico" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Yubico</span></a> <a href="https://twit.social/tags/Yubikey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Yubikey</span></a> </p><p>======</p><p>Vincent Bernat Turns Three YubiKeys and a Cheap Single-Board Computer Into a Secure Offline PKI <br><a href="https://www.hackster.io/news/vincent-bernat-turns-three-yubikeys-and-a-cheap-single-board-computer-into-a-secure-offline-pki-1735b4ad7fc2" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">hackster.io/news/vincent-berna</span><span class="invisible">t-turns-three-yubikeys-and-a-cheap-single-board-computer-into-a-secure-offline-pki-1735b4ad7fc2</span></a></p><p>---<br>Developer Vincent Bernat demonstrates how to turn three Yubico YubiKey USB two-factor authentication dongles into an offline public key infrastructure (PKI) using a low-cost single-board computer as an air-gapped host.</p>
Netzpalaver<p>Nahezu jedes fünfte Online-Zertifikat birgt Sicherheitsrisiken</p><p><a href="https://social.tchncs.de/tags/Authentifizierung" class="mention hashtag" rel="tag">#<span>Authentifizierung</span></a> <a href="https://social.tchncs.de/tags/Datenverschl%C3%BCsselung" class="mention hashtag" rel="tag">#<span>Datenverschlüsselung</span></a> <a href="https://social.tchncs.de/tags/DigitalTrust" class="mention hashtag" rel="tag">#<span>DigitalTrust</span></a> @Keyfactor <a href="https://social.tchncs.de/tags/OnlineZertifikat" class="mention hashtag" rel="tag">#<span>OnlineZertifikat</span></a> <a href="https://social.tchncs.de/tags/PKI" class="mention hashtag" rel="tag">#<span>PKI</span></a> <a href="https://social.tchncs.de/tags/PublicKeyInfrastructure" class="mention hashtag" rel="tag">#<span>PublicKeyInfrastructure</span></a> <a href="https://social.tchncs.de/tags/Schwachstelle" class="mention hashtag" rel="tag">#<span>Schwachstelle</span></a></p><p><a href="https://netzpalaver.de/2025/03/19/nahezu-jedes-fuenfte-online-zertifikat-birgt-sicherheitsrisiken/" target="_blank" rel="nofollow noopener noreferrer" translate="no"><span class="invisible">https://</span><span class="ellipsis">netzpalaver.de/2025/03/19/nahe</span><span class="invisible">zu-jedes-fuenfte-online-zertifikat-birgt-sicherheitsrisiken/</span></a></p>
Cassander<p>Is today <a href="https://infosec.exchange/tags/FediHire" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FediHire</span></a> Friday? Sure looks like it!</p><p>What I'm looking for: A senior level, individual contributor role supporting Windows, Active Directory, Certificates, PKI, Azure, and information security in a large environment. Interested in relocating outside of the US. I like to solve weird problems and make computers run smoothly. I want to help others use technology effectively.</p><p>My main focus the last few years has been rebuilding and modernizing a struggling certificate management team. That includes growing the team to meet our company needs, migrating our AD-integrated private PKI stack, getting a handle on our web PKI consumption, and making massive improvements to our certificate lifecycle management platform. I supported and advised our CyberSec and Desktop teams as we rolled out multi-factor authentication to 50,000 employees and contractors across the US. My background in understanding deep computer fundamentals, talent for quickly grasping nuances of larger systems, and calmness in a crisis have contributed to quickly resolving major technology outages regardless of root cause.</p><p>This role hasn't been exclusively technical. A big part of my current job is building relationships with our developers to help them understand how certificates work, the responsible ways to use them, and what our relevant internal policies are. I've been training and teaching junior and mid-level engineers both practical PKI concepts and our specific enterprise requirements. I've gotten to spend some time with upper management to both explain the immediate challenges we've had and the plans we can implement improve our infrastructure, reducing costs and outages.</p><p>While this position has been focused on certs and how to use them, I'm very comfortable considering a technical leadership role for Windows (server and desktop) administration and Active Directory. I also have some good experience with Azure and virtualization platforms, but they haven't been my daily focus for several years.</p><p>My current employer is direct retail for general public consumers. I've also worked in banking/finance, manufacturing, and architecture firms. The common thread is I love to help people leverage technology for their goals, to help them be more effective. </p><p>In my personnel/volunteer time I've done very similar: working backstage with lights/sounds/projections so live performers can do their best. </p><p>Right now I'm in Syracuse, New York (about five hours from NYC), but I'm open to relocation/migration anywhere in the world. </p><p>PMs open if you want to talk details. Boosts/reshares appreciated.</p><p><a href="https://infosec.exchange/tags/Job" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Job</span></a> <a href="https://infosec.exchange/tags/GetFediHired" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>GetFediHired</span></a> <a href="https://infosec.exchange/tags/ITJobs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ITJobs</span></a> <a href="https://infosec.exchange/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Windows</span></a> <a href="https://infosec.exchange/tags/ActiveDirectory" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ActiveDirectory</span></a> <a href="https://infosec.exchange/tags/Certificate" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Certificate</span></a> <a href="https://infosec.exchange/tags/PKI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PKI</span></a> <a href="https://infosec.exchange/tags/Azure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Azure</span></a> <a href="https://infosec.exchange/tags/Migration" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Migration</span></a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/InfoSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InfoSecurity</span></a></p>
Dyne.org foundation<p>🔥 Forkbomb B.V. is a member of the PKI Consortium!</p><p>The Public Key Infrastructure Consortium unites leading organizations to enhance trust in assets and communication via PKI, improving internet security. By collaborating with users, regulators, and stakeholders, the consortium tackles real-world issues effectively. </p><p>🔗 <a href="https://pkic.org/members/forkbomb/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">pkic.org/members/forkbomb/</span><span class="invisible"></span></a></p><p><a href="https://toot.community/tags/PKI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PKI</span></a> <a href="https://toot.community/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cybersecurity</span></a></p>
Netzpalaver<p>Risikomanagement von Zertifikaten</p><p><a href="https://social.tchncs.de/tags/CommandRiskIntelligence" class="mention hashtag" rel="tag">#<span>CommandRiskIntelligence</span></a> @Keyfactor <a href="https://social.tchncs.de/tags/PKI" class="mention hashtag" rel="tag">#<span>PKI</span></a> <a href="https://social.tchncs.de/tags/PKIaaS" class="mention hashtag" rel="tag">#<span>PKIaaS</span></a> <a href="https://social.tchncs.de/tags/PostQuantumKryptografie" class="mention hashtag" rel="tag">#<span>PostQuantumKryptografie</span></a> <a href="https://social.tchncs.de/tags/Risikomanagement" class="mention hashtag" rel="tag">#<span>Risikomanagement</span></a> <a href="https://social.tchncs.de/tags/Zertifikat" class="mention hashtag" rel="tag">#<span>Zertifikat</span></a> <a href="https://social.tchncs.de/tags/Zertifikatsrisiko" class="mention hashtag" rel="tag">#<span>Zertifikatsrisiko</span></a></p><p><a href="https://netzpalaver.de/2025/03/06/risikomanagement-von-zertifikaten/" target="_blank" rel="nofollow noopener noreferrer" translate="no"><span class="invisible">https://</span><span class="ellipsis">netzpalaver.de/2025/03/06/risi</span><span class="invisible">komanagement-von-zertifikaten/</span></a></p>
Milan Kazarka<p>Feel free to test this - <a href="https://testflight.apple.com/join/FRMUTdnW" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">testflight.apple.com/join/FRMU</span><span class="invisible">TdnW</span></a> - an app I'm working on for verification of authorship of photos (through PKI challenges - through the stored private keys of the author) - for more info feel free to contact me.<br>-<br>The project page is at <a href="https://2p0.space" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">2p0.space</span><span class="invisible"></span></a><br><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/testing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>testing</span></a> <a href="https://infosec.exchange/tags/pki" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pki</span></a></p>
Marcus Lundblad<p>The SignServer team is happy to announce the community release of SignServer 7.0.0:</p><p><a href="https://github.com/Keyfactor/signserver-ce/releases/tag/v7.0.0" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/Keyfactor/signserve</span><span class="invisible">r-ce/releases/tag/v7.0.0</span></a></p><p><a href="https://fosstodon.org/tags/SignServer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SignServer</span></a> <a href="https://fosstodon.org/tags/Keyfactor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Keyfactor</span></a> <a href="https://fosstodon.org/tags/KeyfactorCommunity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>KeyfactorCommunity</span></a> <a href="https://fosstodon.org/tags/codesigning" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>codesigning</span></a> <a href="https://fosstodon.org/tags/DigitalSign" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DigitalSign</span></a> <a href="https://fosstodon.org/tags/pki" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pki</span></a> <a href="https://fosstodon.org/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a></p>
Larvitz :fedora: :redhat:<p>Let's Encrypt soon starts offering TLS certificates with just 6 days of lifetime. It's just an option and the 90 day certs are also still offered but I doubt that this will add a lot of security.</p><p><a href="https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">letsencrypt.org/2025/01/16/6-d</span><span class="invisible">ay-and-ip-certs/</span></a></p><p>Based on the number of occasions, I already had problems with the 90days renewals in the past (software bugs and human error), I see this the value in this move rather sceptical.</p><p><a href="https://burningboard.net/tags/tls" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>tls</span></a> <a href="https://burningboard.net/tags/letsencrypt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>letsencrypt</span></a> <a href="https://burningboard.net/tags/certificates" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>certificates</span></a> <a href="https://burningboard.net/tags/pki" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pki</span></a></p>
mkj<p><span class="h-card" translate="no"><a href="https://social.uggs.io/@chris" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>chris</span></a></span> This sounds very similar to HTTP Public Key Pinning (HPKP), and sounds like it could have much the same issues and failure modes as HPKP. Only obvious difference being that you're proposing DNS as the delivery mechanism whereas HPKP used HTTP response headers, so it would generalize more readily to non-HTTP protocols.</p><p><a href="https://social.mkj.earth/tags/PKI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PKI</span></a> <a href="https://social.mkj.earth/tags/HPKP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>HPKP</span></a></p>
Christian<p>🚨 Fixing the PKI Mess: CAA + Your Own CA via DNS 🚨 </p><p>Right now, any CA can issue a certificate for your domain. Even if you set a CAA record (`issue "letsencrypt.org"`), it only controls *who* can issue, not what cert is valid. This is broken. </p><p>🔐 What if we could fix this using DNS? </p><p><a href="https://social.uggs.io/tags/Introducing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Introducing</span></a> CAA+CA Fingerprint: Self-Sovereign Certificate Authority<br>Instead of just saying *which CA can issue*, you publish your own CA's fingerprint in DNS. If your CA issues a cert for `awesomecars.com`, browsers should validate it against the DNS-published CA key. </p><p>🔥 How It Works<br>You run your own CA (because why trust the cartel?). You then publish: <br>1️⃣ A CAA record specifying your own CA (with a fingerprint! 🔥) <br>2️⃣ A DNS record with your CA’s public key (like DKIM but for TLS!) </p><p>🔹 Example DNS Setup for `awesomecars.com`: <br>```<br>awesomecars.com. IN CAA 0 issue "pki.awesomecars.com; sha256=abcd1234..."<br>pki.awesomecars.com. IN CERT 6 0 0 (--BEGIN CERTIFICATE-- ....)<br>```<br>Now, only certs signed by your CA are valid for `awesomecars.com`, even if another CA is tricked into issuing a rogue cert. No more CA hijacking! </p><p>🚀 Why Is This Better Than the Current CA Model?<br>✅ Self-Sovereign Identity: If you own the domain, you should own its PKI. <br>✅ Prevents Rogue Certs: No government or rogue CA can fake a cert for your domain. <br>✅ Works Like DKIM for Email: Your CA’s public key is stored in DNSSEC-protected records, just like DKIM keys for email signing. <br>✅ No More External Trust Issues: You control your CA entirely, instead of relying on Google’s CA store. <br>✅ Perfect for Self-Hosting & Internal Networks: No need for external CA trust—your DNS is your trust model. </p><p>🔥 Why Isn’t This a Thing Already?<br>Big Tech hates this idea because it removes their control: <br>❌ Google wants Certificate Transparency (CT), where they control which certs are logged. <br>❌ Commercial CAs make $$$ selling certs. This kills their business. <br>❌ DNSSEC adoption is intentionally kept low by the same companies who don’t want this to succeed. </p><p>Browsers refuse to support TLSA for the same reason—they want centralized CA trust, not self-hosted PKI. </p><p>🔗 Who Needs to Implement This?<br>🚀 Self-hosters & Homelabs: Use this for your own infrastructure. <br>🚀 Email providers: Stop relying on public CAs! <br>🚀 Privacy-focused projects (Tor, Matrix, XMPP, Fediverse, etc.): A true decentralized PKI alternative. <br>🚀 Fediverse devs: Let’s push for DNS-based CA validation! </p><p>What do you think? Would you trust your own CA in DNS over some random commercial CA? </p><p>🔁 Boost this if you want a decentralized PKI revolution! </p><p>🔥 This keeps the focus on self-hosting your own CA, highlights the security flaws of current PKI, and calls out Big Tech’s resistance to decentralized trust. </p><p><a href="https://social.uggs.io/tags/PKI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PKI</span></a> <a href="https://social.uggs.io/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Security</span></a> <a href="https://social.uggs.io/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DNSSEC</span></a> <a href="https://social.uggs.io/tags/DANE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DANE</span></a> <a href="https://social.uggs.io/tags/TLSA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>TLSA</span></a> <a href="https://social.uggs.io/tags/CAA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CAA</span></a> <a href="https://social.uggs.io/tags/SelfHosting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SelfHosting</span></a> <a href="https://social.uggs.io/tags/Fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Fediverse</span></a> <a href="https://social.uggs.io/tags/Privacy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Privacy</span></a> <a href="https://social.uggs.io/tags/Decentralization" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Decentralization</span></a> <a href="https://social.uggs.io/tags/dns" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>dns</span></a> <a href="https://social.uggs.io/tags/linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>linux</span></a></p>
Christian<p>Why oh why do Browsers not check TLSA records? We could break free of the messy PKI infrastructure.</p><p><a href="https://social.uggs.io/tags/firefox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>firefox</span></a> <a href="https://social.uggs.io/tags/chrome" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>chrome</span></a> <a href="https://social.uggs.io/tags/safari" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>safari</span></a> <a href="https://social.uggs.io/tags/browser" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>browser</span></a> <a href="https://social.uggs.io/tags/ca" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ca</span></a> <a href="https://social.uggs.io/tags/pki" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pki</span></a> <a href="https://social.uggs.io/tags/linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>linux</span></a> <a href="https://social.uggs.io/tags/internet" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>internet</span></a></p>
gary<p><span class="h-card" translate="no"><a href="https://infosec.exchange/@Em0nM4stodon" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>Em0nM4stodon</span></a></span> not only is it good opsec but for biz in particular they want and need secure comms - just to conduct business <a href="https://infosec.exchange/tags/alice" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>alice</span></a> and bob <a href="https://infosec.exchange/tags/bb84" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>bb84</span></a> <a href="https://infosec.exchange/tags/pki" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pki</span></a> <a href="https://infosec.exchange/tags/qkd" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>qkd</span></a> <a href="https://infosec.exchange/tags/5g" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>5g</span></a> security <a href="https://infosec.exchange/tags/evercookie" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>evercookie</span></a></p>
Marcus Regenberg | marreg<p><a href="https://digitalcourage.social/tags/NetHSM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NetHSM</span></a> - Das vertrauenswürdige, offene Hardware-Sicherheitsmodul, das einfach funktioniert</p><p>🇨🇭 Sicherer Speicher für kryptografische Schlüssel (z. B. <a href="https://digitalcourage.social/tags/TLS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>TLS</span></a> von <a href="https://digitalcourage.social/tags/Webservern" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Webservern</span></a>, <a href="https://digitalcourage.social/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DNSSEC</span></a>, <a href="https://digitalcourage.social/tags/PKI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PKI</span></a>, <a href="https://digitalcourage.social/tags/CA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CA</span></a>, <a href="https://digitalcourage.social/tags/Blockchain" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Blockchain</span></a>)<br>🇨🇭 <a href="https://digitalcourage.social/tags/OffenerQuellcode" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OffenerQuellcode</span></a> ermöglicht die Überprüfung, dass keine Hintertüren enthalten sind<br>🇨🇭 Einfach zu bedienen durch moderne <a href="https://digitalcourage.social/tags/REST" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>REST</span></a>-Schnittstelle und moderne Software-Tools<br>🇨🇭 Hergestellt in Deutschland</p><p>→ <a href="https://www.nitrokey.com/de/produkte/nethsm" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">nitrokey.com/de/produkte/neths</span><span class="invisible">m</span></a></p><p><a href="https://digitalcourage.social/tags/madeingermany" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>madeingermany</span></a></p>
Netzpalaver<p>Warum digitale Zertifikate manuell weder effektiv noch effizient gemanagt werden können</p><p><a href="https://social.tchncs.de/tags/Compliance" class="mention hashtag" rel="tag">#<span>Compliance</span></a> <a href="https://social.tchncs.de/tags/DigitaleZertifikate" class="mention hashtag" rel="tag">#<span>DigitaleZertifikate</span></a> <a href="https://social.tchncs.de/tags/IoT" class="mention hashtag" rel="tag">#<span>IoT</span></a> @Keyfactor <a href="https://social.tchncs.de/tags/PKI" class="mention hashtag" rel="tag">#<span>PKI</span></a> <a href="https://social.tchncs.de/tags/PKIasaService" class="mention hashtag" rel="tag">#<span>PKIasaService</span></a> <a href="https://social.tchncs.de/tags/PublicKeyInfrastructure" class="mention hashtag" rel="tag">#<span>PublicKeyInfrastructure</span></a> <a href="https://social.tchncs.de/tags/Zertifikatswildwuchs" class="mention hashtag" rel="tag">#<span>Zertifikatswildwuchs</span></a></p><p><a href="https://netzpalaver.de/2025/01/20/warum-digitale-zertifikate-manuell-weder-effektiv-noch-effizient-gemanagt-werden-koennen/" target="_blank" rel="nofollow noopener noreferrer" translate="no"><span class="invisible">https://</span><span class="ellipsis">netzpalaver.de/2025/01/20/waru</span><span class="invisible">m-digitale-zertifikate-manuell-weder-effektiv-noch-effizient-gemanagt-werden-koennen/</span></a></p>
Jens Brückner 😷 :debian:<p>New <a href="https://social.tchncs.de/tags/year" class="mention hashtag" rel="tag">#<span>year</span></a>, new <a href="https://social.tchncs.de/tags/hope" class="mention hashtag" rel="tag">#<span>hope</span></a>, new <a href="https://social.tchncs.de/tags/trust" class="mention hashtag" rel="tag">#<span>trust</span></a>. <br />All <a href="https://social.tchncs.de/tags/servers" class="mention hashtag" rel="tag">#<span>servers</span></a> and <a href="https://social.tchncs.de/tags/instances" class="mention hashtag" rel="tag">#<span>instances</span></a> <a href="https://social.tchncs.de/tags/docker" class="mention hashtag" rel="tag">#<span>docker</span></a> <a href="https://social.tchncs.de/tags/kubernetes" class="mention hashtag" rel="tag">#<span>kubernetes</span></a> <a href="https://social.tchncs.de/tags/k8" class="mention hashtag" rel="tag">#<span>k8</span></a> are now running with renewed <a href="https://social.tchncs.de/tags/certificates" class="mention hashtag" rel="tag">#<span>certificates</span></a>. <br /><a href="https://social.tchncs.de/tags/ssl" class="mention hashtag" rel="tag">#<span>ssl</span></a> <a href="https://social.tchncs.de/tags/tls" class="mention hashtag" rel="tag">#<span>tls</span></a> <a href="https://social.tchncs.de/tags/openssl" class="mention hashtag" rel="tag">#<span>openssl</span></a> <a href="https://social.tchncs.de/tags/openvpn" class="mention hashtag" rel="tag">#<span>openvpn</span></a> <a href="https://social.tchncs.de/tags/shell" class="mention hashtag" rel="tag">#<span>shell</span></a> <a href="https://social.tchncs.de/tags/cli" class="mention hashtag" rel="tag">#<span>cli</span></a> <a href="https://social.tchncs.de/tags/key" class="mention hashtag" rel="tag">#<span>key</span></a> <a href="https://social.tchncs.de/tags/req" class="mention hashtag" rel="tag">#<span>req</span></a> <a href="https://social.tchncs.de/tags/crt" class="mention hashtag" rel="tag">#<span>crt</span></a> </p><p>Become your own certificate authority (CA), with <a href="https://social.tchncs.de/tags/easyrsa" class="mention hashtag" rel="tag">#<span>easyrsa</span></a> <br /><a href="https://social.tchncs.de/tags/pki" class="mention hashtag" rel="tag">#<span>pki</span></a> <a href="https://social.tchncs.de/tags/ca" class="mention hashtag" rel="tag">#<span>ca</span></a></p>
Netzpalaver<p>Was die neue Bekanntmachung des NIST für die Umstellung auf die Quantenkryptographie bedeutet</p><p><a href="https://social.tchncs.de/tags/Cybersecurity" class="mention hashtag" rel="tag">#<span>Cybersecurity</span></a> <a href="https://social.tchncs.de/tags/Cybersicherheit" class="mention hashtag" rel="tag">#<span>Cybersicherheit</span></a> @Keyfactor <a href="https://social.tchncs.de/tags/NIST" class="mention hashtag" rel="tag">#<span>NIST</span></a> <a href="https://social.tchncs.de/tags/PKI" class="mention hashtag" rel="tag">#<span>PKI</span></a> <a href="https://social.tchncs.de/tags/PQC" class="mention hashtag" rel="tag">#<span>PQC</span></a> <a href="https://social.tchncs.de/tags/Quantencomputer" class="mention hashtag" rel="tag">#<span>Quantencomputer</span></a> <a href="https://social.tchncs.de/tags/Quantenkryptographie" class="mention hashtag" rel="tag">#<span>Quantenkryptographie</span></a> <a href="https://social.tchncs.de/tags/Verschl%C3%BCsselung" class="mention hashtag" rel="tag">#<span>Verschlüsselung</span></a></p><p><a href="https://netzpalaver.de/2025/01/16/was-die-neue-bekanntmachung-des-nist-fuer-die-umstellung-auf-die-quantenkryptographie-bedeutet/" target="_blank" rel="nofollow noopener noreferrer" translate="no"><span class="invisible">https://</span><span class="ellipsis">netzpalaver.de/2025/01/16/was-</span><span class="invisible">die-neue-bekanntmachung-des-nist-fuer-die-umstellung-auf-die-quantenkryptographie-bedeutet/</span></a></p>
Peter N. M. Hansteen<p>rpki-client 9.4 released <a href="https://www.undeadly.org/cgi?action=article;sid=20250108100744" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">undeadly.org/cgi?action=articl</span><span class="invisible">e;sid=20250108100744</span></a> <a href="https://mastodon.social/tags/openbsd" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>openbsd</span></a> <a href="https://mastodon.social/tags/rpki" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>rpki</span></a>-client <a href="https://mastodon.social/tags/rpki" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>rpki</span></a> <a href="https://mastodon.social/tags/pki" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pki</span></a> <a href="https://mastodon.social/tags/routing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>routing</span></a> <a href="https://mastodon.social/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>security</span></a> <a href="https://mastodon.social/tags/networking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>networking</span></a></p>
ExploreLive feeds
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Create accountLoginDrag & drop to upload