<![CDATA[Well isn't learning how to run your own CA a lot of fun?]]>Well isn't learning how to run your own CA a lot of fun?

And by "fun", I mean "debugging".

And by "a lot", I mean "a looooooooooot".

I am making progress, today around SAN and Firefox, but this is a bit like plodding around in treacle.

(I'm not looking for advice, although sympathy is welcome :))

]]>https://board.circlewithadot.net/topic/f26241f6-e224-41bd-8140-20af9cfe20fc/well-isn-t-learning-how-to-run-your-own-ca-a-lot-of-funRSS for NodeFri, 15 May 2026 06:42:14 GMTThu, 30 Apr 2026 15:34:29 GMT60<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 16:08:19 GMT]]>@neil 10 years ago I worked on a project implementing PKI including CA, time-stamping, document signers, browser plugins and an installer of all the SW for universities in Slovakia.

You have my sympathies:P

]]>https://board.circlewithadot.net/post/https://mastodon.online/users/matus_chochlik/statuses/116494519461761154https://board.circlewithadot.net/post/https://mastodon.online/users/matus_chochlik/statuses/116494519461761154Thu, 30 Apr 2026 16:08:19 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 16:06:51 GMT]]>@neil I am so looking forward to it!

]]>https://board.circlewithadot.net/post/https://mastodon.me.uk/users/brunogirin/statuses/116494513700722972https://board.circlewithadot.net/post/https://mastodon.me.uk/users/brunogirin/statuses/116494513700722972Thu, 30 Apr 2026 16:06:51 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 16:06:04 GMT]]>@hannes openssl

]]>https://board.circlewithadot.net/post/https://mastodon.neilzone.co.uk/users/neil/statuses/116494510621846417https://board.circlewithadot.net/post/https://mastodon.neilzone.co.uk/users/neil/statuses/116494510621846417Thu, 30 Apr 2026 16:06:04 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 16:05:12 GMT]]>@neil are you using openssl command line or some scripts/tooling on top of it?

]]>https://board.circlewithadot.net/post/https://social.coop/users/hannes/statuses/116494507183297781https://board.circlewithadot.net/post/https://social.coop/users/hannes/statuses/116494507183297781Thu, 30 Apr 2026 16:05:12 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 16:04:59 GMT]]>@neil been there, done that. there are more fun things in life.

]]>https://board.circlewithadot.net/post/https://social.treehouse.systems/users/kate/statuses/116494506346552479https://board.circlewithadot.net/post/https://social.treehouse.systems/users/kate/statuses/116494506346552479Thu, 30 Apr 2026 16:04:59 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 16:04:27 GMT]]>@neil i have it pinned in my calendar

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/gary_alderson/statuses/116494504252226904https://board.circlewithadot.net/post/https://infosec.exchange/users/gary_alderson/statuses/116494504252226904Thu, 30 Apr 2026 16:04:27 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 16:02:49 GMT]]>You can expect a riveting blogpost in due course.

And by "riveting", I mean "utterly tedious and unnecessary unless you, too, have the misfortune to want to run your own certificate authority".

]]>https://board.circlewithadot.net/post/https://mastodon.neilzone.co.uk/users/neil/statuses/116494497824618056https://board.circlewithadot.net/post/https://mastodon.neilzone.co.uk/users/neil/statuses/116494497824618056Thu, 30 Apr 2026 16:02:49 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 15:57:49 GMT]]>@neil So. Sympathy.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bencurthoys/statuses/116494478171471593https://board.circlewithadot.net/post/https://mastodon.social/users/bencurthoys/statuses/116494478171471593Thu, 30 Apr 2026 15:57:49 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 15:57:39 GMT]]>@neil The answer, it turns out, is that the string was being built from a GUID, and their platform serialised the GUID with lowercase hex and mine with uppercase hex, and your eye doesn't notice the case of the letters when looking at hex values, so I couldn't see that they were different.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bencurthoys/statuses/116494477497577714https://board.circlewithadot.net/post/https://mastodon.social/users/bencurthoys/statuses/116494477497577714Thu, 30 Apr 2026 15:57:39 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 15:56:13 GMT]]>@neil The best part about debugging anything to do with certificates or encryption or security is that any useful debugging information is a security leak... so you don't get any. Either it works, or it doesn't work and it refuses to tell you why.

Sometimes it's mathematically impossible for it to tell you why. Once I lost more than a day working out why, when I hashed a string, I got a different hash value than was expected, when my hash function returned the same expected value on test data.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bencurthoys/statuses/116494471916153455https://board.circlewithadot.net/post/https://mastodon.social/users/bencurthoys/statuses/116494471916153455Thu, 30 Apr 2026 15:56:13 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 15:52:34 GMT]]>@ColinTheMathmo Certificate Authority

]]>https://board.circlewithadot.net/post/https://mastodon.neilzone.co.uk/users/neil/statuses/116494457521288257https://board.circlewithadot.net/post/https://mastodon.neilzone.co.uk/users/neil/statuses/116494457521288257Thu, 30 Apr 2026 15:52:34 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 15:51:32 GMT]]>@neil Two things:

(a) What's a "CA" in this context?

(b) *Sympathy*

]]>https://board.circlewithadot.net/post/https://mathstodon.xyz/users/ColinTheMathmo/statuses/116494453471042370https://board.circlewithadot.net/post/https://mathstodon.xyz/users/ColinTheMathmo/statuses/116494453471042370Thu, 30 Apr 2026 15:51:32 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 15:51:24 GMT]]>@prsfalken thx

]]>https://board.circlewithadot.net/post/https://ohai.social/users/GreenSkyOverMe/statuses/116494452973003326https://board.circlewithadot.net/post/https://ohai.social/users/GreenSkyOverMe/statuses/116494452973003326Thu, 30 Apr 2026 15:51:24 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 15:51:11 GMT]]>@neil thx

]]>https://board.circlewithadot.net/post/https://ohai.social/users/GreenSkyOverMe/statuses/116494452081082285https://board.circlewithadot.net/post/https://ohai.social/users/GreenSkyOverMe/statuses/116494452081082285Thu, 30 Apr 2026 15:51:11 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 15:46:48 GMT]]>@matthewcroughan

There are some services that I run where I would like TLS, would prefer not to expose them to the Internet, am not keen on moving around Let's Encrypt cert, and would prefer them to be trusted certificates rather than self-signed certificates, to work better on mobile devices.

Also, a fun learning exercise.

]]>https://board.circlewithadot.net/post/https://mastodon.neilzone.co.uk/users/neil/statuses/116494434832241479https://board.circlewithadot.net/post/https://mastodon.neilzone.co.uk/users/neil/statuses/116494434832241479Thu, 30 Apr 2026 15:46:48 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 15:46:45 GMT]]>]]>https://board.circlewithadot.net/post/https://snac.smithies.me.uk/justine/p/1777564005.153801https://board.circlewithadot.net/post/https://snac.smithies.me.uk/justine/p/1777564005.153801Thu, 30 Apr 2026 15:46:45 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 15:46:34 GMT]]>@neil I look forward to the blog post for this one! Sounds like a more challenging project than usual.

]]>https://board.circlewithadot.net/post/https://social.seabass.systems/users/seabass/statuses/01KQFH41X6T3BWMQ370BZA12EJhttps://board.circlewithadot.net/post/https://social.seabass.systems/users/seabass/statuses/01KQFH41X6T3BWMQ370BZA12EJThu, 30 Apr 2026 15:46:34 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 15:45:35 GMT]]>@GreenSkyOverMe Certificate Authority

]]>https://board.circlewithadot.net/post/https://mastodon.neilzone.co.uk/users/neil/statuses/116494430088676013https://board.circlewithadot.net/post/https://mastodon.neilzone.co.uk/users/neil/statuses/116494430088676013Thu, 30 Apr 2026 15:45:35 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 15:45:06 GMT]]>@neil Are you doing okay, Neil? Who has a gun pointing at you and telling you to run your own CA? Is it @babe again? 👀

]]>https://board.circlewithadot.net/post/https://fosstodon.org/users/graves501/statuses/116494428194618164https://board.circlewithadot.net/post/https://fosstodon.org/users/graves501/statuses/116494428194618164Thu, 30 Apr 2026 15:45:06 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 15:42:05 GMT]]>@GreenSkyOverMe @neil Something you usually don't selfhost and if you do ... Avoid to mess with

XD

(Certificate authority, if I'm not mistaken)

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/prsfalken/statuses/116494416339200959https://board.circlewithadot.net/post/https://mastodon.social/users/prsfalken/statuses/116494416339200959Thu, 30 Apr 2026 15:42:05 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 15:41:44 GMT]]>@matthewcroughan @neil
My question exactly. Why?

]]>https://board.circlewithadot.net/post/https://mastodon.me.uk/users/brunogirin/statuses/116494414916148901https://board.circlewithadot.net/post/https://mastodon.me.uk/users/brunogirin/statuses/116494414916148901Thu, 30 Apr 2026 15:41:44 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 15:41:28 GMT]]>@neil good luck!

]]>https://board.circlewithadot.net/post/https://tilde.zone/users/9pfs/statuses/116494413915748799https://board.circlewithadot.net/post/https://tilde.zone/users/9pfs/statuses/116494413915748799Thu, 30 Apr 2026 15:41:28 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 15:41:15 GMT]]>@GreenSkyOverMe @neil certificate authority

]]>https://board.circlewithadot.net/post/https://tilde.zone/users/9pfs/statuses/116494413007265104https://board.circlewithadot.net/post/https://tilde.zone/users/9pfs/statuses/116494413007265104Thu, 30 Apr 2026 15:41:15 GMT<![CDATA[Reply to Well isn't learning how to run your own CA a lot of fun? on Thu, 30 Apr 2026 15:38:18 GMT]]>https://board.circlewithadot.net/post/https://social.defenestrate.it/objects/6aa88ca3-eb74-42f7-88f3-7327166c54e4https://board.circlewithadot.net/post/https://social.defenestrate.it/objects/6aa88ca3-eb74-42f7-88f3-7327166c54e4Thu, 30 Apr 2026 15:38:18 GMT