Ask HN: How do you manage SSH keys and SSL certificates in your company?

Re:Ask HN: How do you manage SSH keys and SSL certificates i... by blakesterz on Friday May 12, 2017 @08:05AM (#14323214)

Do you use Ansible for SSL as well? How do you store the keys?

[ Parent | on HN ]

Re:Ask HN: How do you manage SSH keys and SSL certificates i... by atmosx on Sunday May 14, 2017 @06:56AM (#14335088)

Using ansible-vault, check out this gist:

https://gist.github.com/tristanfisher/e5a306144a637dc739e7

Having a partly encrypted YAML file is also available since version 2.3.0

Key management and deployment are two different things. Installing up people's private keys on the hosts, doesn't involve any management. It's a standard sysadmin procedure.

Key managements involves policies such as: key rotation, algorithms to use, access restriction control, etc. It is way more daunting and complex. I don't see how ansible what ansible has to do with this, vaultproject on the other hand has most of the these features (and more) build-in. Never used it, but I know about it through a podcast presentation of vault in "Arrested Devops" IIRC.

[ Parent | on HN ]

Re:Ask HN: How do you manage SSH keys and SSL certificates i... by throwaway18917 on Friday May 12, 2017 @08:29AM (#14323369)

Ansible has a featur called Vault that encrypts whatever you tell it to with a password. You can then upload that to version control, and when you want to deploy, you just pass the password to Ansible (either via a file or any environment variable, ideally).

I'm using it to migrate us over from keeping our SSL cert in Dropbox and 1Password and it works well.

[ Parent | on HN ]