News for hackers. Stuff that matters.

A comment on Show HN: Bifrost MTLS Authentication. Parent comment

Re:Show HN: Bifrost MTLS Authentication by pcpuser on Saturday June 22, 2024 @07:21PM (#40763145)
The UUID is "sent" to the server in the signed certificate. Not in the clear or over an app protocol like HTTP. There's no way to fake this UUID.
[ Parent | on HN ]
Re:Show HN: Bifrost MTLS Authentication by Grimeton on Saturday June 22, 2024 @07:37PM (#40763254)
I'm talking about sending the CSR to the server that runs on http.

    Bifrost CA server is a plain HTTP server that responds to X.509 Certificate Signing Requests (CSRs) sent via POST requests. The server validates CSRs, signs them, and returns signed certificates to clients.
*PLAIN* http server.

and also mentioning how operators can secure access to the server.

Also it says:

    Bifrost recognises clients by their ECDSA P-256 key pairs. A client’s UUID is the hash of the public key and the namespace. The namespace is any UUID that identifies a domain or application.
When you send a CSR, the CSR contains the public key.

You __REALLY__ need to read up on x.509.

[ Parent | on HN ]