When I have the UUID, then I can get a CSR signed on the server because that's all that's needed. Creating a CSR creats my private key for the CSR and once the CSR is signed and the certificate is returned I have a valid keypair.
Again, completely off the mark here. To create any CSR, bifrost or not, you need the private key that the CSR represents.
> Creating a CSR creats my private key for the CSR...
Not really sure what's going on here tbh.
> Again, completely off the mark here. To create any CSR, bifrost or not, you need the private key that the CSR represents.
Yeah... No. You create a public/private key pair and the CSR CONTAINS that public key together with additional information.
>Not really sure what's going on here tbh.
I'm not surprised. Go read up on this stuff.
Please read this section carefully: https://datatracker.ietf.org/doc/html/rfc2986#section-3
The CSR contains the digital signature of the public key that is requesting the certificate. So you absolutely need the private key to create a CSR. How would you create a CSR with just a public key?
>The CSR contains the digital signature of the public key that is requesting the certificate. So you absolutely need the private key to create a CSR. How would you create a CSR with just a public key?
Do you really not know what you're talking about or are you trolling at this point?
> Please read this section carefully: https://datatracker.ietf.org/doc/html/rfc2986#section-3
Yeah, go read it:
The
certification request information consists of the entity's
distinguished name, the entity's public key, and a set of attributes
providing other information about the entity.
You can't fake the UUID in mTLS because you need the actual private key to be present with the client when it makes a connection to the server. There's no way to fake this in TLS.