TLS Mastery - Hackdot

Re:TLS Mastery by eandre on Sunday April 11, 2021 @09:19AM (#26770162)

TLS always felt like a scary beast to me until I started writing Go. The crypto/tls package is amazing and makes doing incredible things with TLS super easy. We're using it in lots of interesting ways behind the scenes for Encore, leveraging Vault, a custom CA, SPIFFE for workload identity and more.

I haven't read the book, but learning more about TLS is easily one of the best time investments I've made.

[ Parent | on HN ]

Re:TLS Mastery by rad_gruchalski on Sunday April 11, 2021 @11:32AM (#26770983)

> TLS always felt like a scary beast to me until I started writing Go. The crypto/tls package is amazing and makes doing incredible things with TLS super easy.

This x100. I have been recently developing an embedded CA for a gRPC service in golang. Issuing a root, intermediate, server and a client cert for mtls is less than 350 lines of code. It’s incredible.

I’ve written more about it here: https://gruchalski.com/posts/2021-03-28-firebuild-rootfs-grp....

[ Parent | on HN ]

Re:TLS Mastery by fierro on Monday April 12, 2021 @01:34AM (#26776325)

just curious, what do you need SPIFEE workload identity for? I've used it in the past for building something like Tailscale

[ Parent | on HN ]

Re:TLS Mastery by eandre on Monday April 12, 2021 @05:12AM (#26777345)

We use it as part of mTLS to provide access to application metadata. It doesn't need to be SPIFFE but it made sense for our use case :)

[ Parent | on HN ]

Re:TLS Mastery by fierro on Monday April 12, 2021 @07:27PM (#26786418)

I see, so a workload spins up and wants to learn something about itself and uses identity verification to gain access to it? My use case was an untrusted node getting a centrally issued key to join a p2p VPN

[ Parent | on HN ]