5 ms·
The HTTP header comparison at the end is so close but so far. The auth in the server is basically your tsv file. You can't fake the UUID in mTLS because you ne
by pcpuser 2y ago
The HTTP header comparison at the end is so close but so far. The auth in the server is basically your tsv file.
You can't fake the UUID in mTLS because you need the actual private key to be present with the client when it makes a connection to the server. There's no way to fake this in TLS.
- Grimeton 2y agoWhen I have the UUID, then I can get a CSR signed on the server because that's all that's needed. Creating a CSR creats my private key for the CSR and once the CSR is signed and the certificate is returned I have a valid keypair.
- pcpuser 2y agoAgain, completely off the mark here. To create any CSR, bifrost or not, you need the private key that the CSR represents. > Creating a CSR creats my private key for the CSR... Not really sure what's going on here tbh.
- Grimeton 2y ago> Again, completely off the mark here. To create any CSR, bifrost or not, you need the private key that the CSR represents. Yeah... No. You create a public/private key pair and the CSR CONTAINS that public key together with additional information. >Not really sure what's going on here tbh. I'm not surprised. Go read up on this stuff.
- pcpuser 2y agoPlease read this section carefully: https://datatracker.ietf.org/doc/html/rfc2986#section-3 https://datatracker.ietf.org/doc/html/rfc2986#section-3 The CSR contains the digital signature of the public key that is requesting the certificate. So you absolutely need the private key to create a CSR. How would you create a CSR with just a public key?
- Grimeton 2y ago>The CSR contains the digital signature of the public key that is requesting the certificate. So you absolutely need the private key to create a CSR. How would you create a CSR with just a public key? Do you really not know what you're talking about or are you trolling at this point?
- Grimeton 2y ago> Please read this section carefully: https://datatracker.ietf.org/doc/html/rfc2986#section-3 https://datatracker.ietf.org/doc/html/rfc2986#section-3 Yeah, go read it: The certification request information consists of the entity's distinguished name, the entity's public key, and a set of attributes providing other information about the entity.
- pcpuser 2y agoSo close once more lol > 2. The CertificationRequestInfo value is signed with the subject entity's private key. (See Section 4.2.) I wonder what this means? Hmm...