Re:Show HN: Bifrost MTLS Authentication
by Grimeton on Saturday June 22, 2024 @01:24PM
(#40760585)
When I have the UUID, then I can get a CSR signed on the server because that's all that's needed. Creating a CSR creats my private key for the CSR and once the CSR is signed and the certificate is returned I have a valid keypair.
[ Parent
| on HN ]
Again, completely off the mark here. To create any CSR, bifrost or not, you need the private key that the CSR represents.
> Creating a CSR creats my private key for the CSR...
Not really sure what's going on here tbh.
> Again, completely off the mark here. To create any CSR, bifrost or not, you need the private key that the CSR represents.
Yeah... No. You create a public/private key pair and the CSR CONTAINS that public key together with additional information.
>Not really sure what's going on here tbh.
I'm not surprised. Go read up on this stuff.
Please read this section carefully: https://datatracker.ietf.org/doc/html/rfc2986#section-3
The CSR contains the digital signature of the public key that is requesting the certificate. So you absolutely need the private key to create a CSR. How would you create a CSR with just a public key?
>The CSR contains the digital signature of the public key that is requesting the certificate. So you absolutely need the private key to create a CSR. How would you create a CSR with just a public key?
Do you really not know what you're talking about or are you trolling at this point?
> Please read this section carefully: https://datatracker.ietf.org/doc/html/rfc2986#section-3
Yeah, go read it:
The
certification request information consists of the entity's
distinguished name, the entity's public key, and a set of attributes
providing other information about the entity.