Re:Down the Cloudflare / Stripe / OWASP Rabbit Hole: A Tale ...
by gz5 on Tuesday February 21, 2023 @11:12AM
(#34882764)
your overlay network fabric infrastructure - ziti edge routers - leverage the ziti edge client API to submit CSRs for new certs x days before expiry.
for client endpoints, there are currently 2 choices and at least 3 in the future:
1. admins chooses to enable client endpoints to continue to auth with expired client certs. the admin revokes access (when necessary) at an endpoint level or at a service level (least privileged access) via those constructs, rather than cert constructs.
2. admins don't permit expired certs to be used. the admin is managing the certs.
3. as a third choice for client endpoints, ziti has plans to enable admins to use the API used by the fabric infra mentioned above. this is future, with timing mainly dependent on openziti community priorities and related work.
for client endpoints, there are currently 2 choices and at least 3 in the future:
1. admins chooses to enable client endpoints to continue to auth with expired client certs. the admin revokes access (when necessary) at an endpoint level or at a service level (least privileged access) via those constructs, rather than cert constructs.
2. admins don't permit expired certs to be used. the admin is managing the certs.
3. as a third choice for client endpoints, ziti has plans to enable admins to use the API used by the fabric infra mentioned above. this is future, with timing mainly dependent on openziti community priorities and related work.