If OpenSSL were a GUI

Re:If OpenSSL were a GUI by georgyo on Friday June 10, 2022 @07:07PM (#31700337)

Mkcert and certbot are new utilities. OpenSSL predates them by decades.

Before acme, someone had to create a CSR manually, often using OpenSSL.

Also, should therw be a separate tool to debug and inspect ssl certs and connection? How many individual tools should there be?

[ Parent | on HN ]

Re:If OpenSSL were a GUI by sreevisakh on Friday June 10, 2022 @07:50PM (#31700609)

Perhaps it's worth mentioning XCA [1] at this point. It's a GUI based on openssl that provides an intuitive UI for managing keys, certs (root CA, intermediate CA, server and client) and CSR. It existed before acme and mkcert. What I liked in XCA was that it made it easy to review all parameters related to the operations it managed.

[1] https://hohnstaedt.de/xca/index.php

[ Parent | on HN ]

Re:If OpenSSL were a GUI by Ayesh on Saturday June 11, 2022 @12:23AM (#31701901)

I continue to use it even today for small root stores I manage for internal networks. Very clean and intuitive UI that gets the job done well.

Also using Kleopatra for GPG keys.

[ Parent | on HN ]

Re:If OpenSSL were a GUI by urda on Saturday June 11, 2022 @01:12AM (#31702118)

+1 XCA. It is a fantastic way to manage your own root CA.

[ Parent | on HN ]

Re:If OpenSSL were a GUI by tptacek on Friday June 10, 2022 @08:08PM (#31700709)

There should be lots of individual tools.

I have bad news for you: LetsEncrypt and ACME are almost 10 years old. Like the rest of us, you're getting old.

[ Parent | on HN ]

Re:If OpenSSL were a GUI by vlovich123 on Saturday June 11, 2022 @12:05AM (#31701818)

LetsEncrypt was founded 7 and started issuing certs about 6 years ago.

[ Parent | on HN ]

Re:If OpenSSL were a GUI by thayne on Saturday June 11, 2022 @02:47AM (#31702508)

> There should be lots of individual tools.

Maybe there should be, but for many things that openssl can do (for example, testing and debugging a TLS connection, examining the contents of a certificate, creating a CSR to send to a non-ACME CA, converting between different formats of certificates, etc.) I'm not aware of good single-purpose tools.

[ Parent | on HN ]

Re:If OpenSSL were a GUI by a2800276 on Saturday June 11, 2022 @03:52AM (#31702756)

> There should be lots of individual tools.

Arguably, OpenSSL is a collection of lots of individual tools. Each of the tabs in the "GUI" is an individual command with its own man-page, etc.

Each command still brings a lot of of options and therefore complexity with it, but that's because the domain is complex.

[ Parent | on HN ]

Re:If OpenSSL were a GUI by thayne on Saturday June 11, 2022 @02:34AM (#31702452)

openssl is more than twice as old as that.

[ Parent | on HN ]

Re:If OpenSSL were a GUI by maccard on Saturday June 11, 2022 @04:31AM (#31702905)

> Mkcert and certbot are new utilities. OpenSSL predates them by decades.

Certbot has been around for 7 years at this point, and is the same age as VS code. Frankly at this stage there's very little excise to not use it.

[ Parent | on HN ]

Re:If OpenSSL were a GUI by up_o on Saturday June 11, 2022 @08:40AM (#31704028)

I use certbot to maintain valid certificates for my website, but there are more use cases for certificates than just https binding--and not all of them lend themselves to LetsEncrypt provisioning. The openssl CLI is definitely not simple, but in my experience it has often been the best available tool for various use cases.

[ Parent | on HN ]

Re:If OpenSSL were a GUI by imtringued on Monday June 13, 2022 @02:40AM (#31722018)

You must use openssl to convert your useless certbot certificates and private keys into something that a Java program can actually use.

[ Parent | on HN ]