Well isn't learning how to run your own CA a lot of fun?

[wurzelmann@mastodon.wurzelmann.at]

@neil *sends some sympathy your way*

[greenskyoverme@ohai.social]

@neil What is a CA?

[matthewcroughan@social.defenestrate.it]

How come you're bothering to do it?

[9pfs@tilde.zone]

@GreenSkyOverMe @neil certificate authority

[9pfs@tilde.zone]

@neil good luck!

[brunogirin@mastodon.me.uk]

@matthewcroughan @neil
My question exactly. Why?

[prsfalken@mastodon.social]

@GreenSkyOverMe @neil Something you usually don't selfhost and if you do ... Avoid to mess with

XD

(Certificate authority, if I'm not mistaken)

[graves501@fosstodon.org]

@neil Are you doing okay, Neil? Who has a gun pointing at you and telling you to run your own CA? Is it @babe again?

[neil@mastodon.neilzone.co.uk]

@GreenSkyOverMe Certificate Authority

[seabass@social.seabass.systems]

@neil I look forward to the blog post for this one! Sounds like a more challenging project than usual.

[justine@snac.smithies.me.uk]

Sending my deepest sympathies to you at these trying times. But letting you know that things will get better.

[neil@mastodon.neilzone.co.uk]

@matthewcroughan

There are some services that I run where I would like TLS, would prefer not to expose them to the Internet, am not keen on moving around Let's Encrypt cert, and would prefer them to be trusted certificates rather than self-signed certificates, to work better on mobile devices.

Also, a fun learning exercise.

[greenskyoverme@ohai.social]

@neil thx

[greenskyoverme@ohai.social]

@prsfalken thx

[colinthemathmo@mathstodon.xyz]

@neil Two things:

(a) What's a "CA" in this context?

(b) *Sympathy*

[neil@mastodon.neilzone.co.uk]

@ColinTheMathmo Certificate Authority

[bencurthoys@mastodon.social]

@neil The best part about debugging anything to do with certificates or encryption or security is that any useful debugging information is a security leak... so you don't get any. Either it works, or it doesn't work and it refuses to tell you why.

Sometimes it's mathematically impossible for it to tell you why. Once I lost more than a day working out why, when I hashed a string, I got a different hash value than was expected, when my hash function returned the same expected value on test data.

[bencurthoys@mastodon.social]

@neil The answer, it turns out, is that the string was being built from a GUID, and their platform serialised the GUID with lowercase hex and mine with uppercase hex, and your eye doesn't notice the case of the letters when looking at hex values, so I couldn't see that they were different.

[bencurthoys@mastodon.social]

@neil So. Sympathy.

[neil@mastodon.neilzone.co.uk]

You can expect a riveting blogpost in due course.

And by "riveting", I mean "utterly tedious and unnecessary unless you, too, have the misfortune to want to run your own certificate authority".