Secure your Cloud Services with TLS X.509 Client Certificates

Подписаться 56 тыс.

Просмотров 14 тыс.

50% 1

How to secure Internet Servers with X.509 Client Certificates? How to deploy X.509 Client Certificates ? How does a Certificate Signing Request (CSR) work ? In this hands-on video we will run a little nodejs Server that requests Authentication with an X.509 Client Certificate, we will Sandbox a CSR with XCA and we will have a look at OpenXPKI which is a great Software to automate processes around TLS and Certificate Generation, Key Management and the like. Last but not least I show a Blueprint on how to securely link a hosted MQTT into your home automation Software.
The XCA Tool can be obtained here: hohnstaedt.de/xca/
More Info on my Cheat Sheet Repo here: github.com/onemarcfifty/cheat...
The nodejs Server Example is on my github: github.com/onemarcfifty/clien...
0:00 The use case
1:27 Get the Demo Server from my Github repo
4:20 How to generate client certificates
5:37 How secure is this?
8:04 How to deploy client certificates
9:16 Certificate Signing requests (CSR)
12:45 OpenXPKI
14:10 A blue print for a secure MQTT / Home Automation App
RU-vid: / onemarcfifty
Twitter: / onemarcfifty
Discord: / discord
Github: github.com/onemarcfifty
Patreon: / onemarcfifty
Blog: www.onemarcfifty.com

Наука

Опубликовано:

1 авг 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 61

@user-nv3xm2pq7c 5 месяцев назад

I really do not know how i watched the best of best tutorials for free here.

@ganonbit 5 месяцев назад

very thorough and helpful for my current project, thank you!

@pberto Год назад

This third episode very confirm I havn't studied enough in my life.......good job, Marc.

@OneMarcFifty Год назад

Thank you ;-)

@issacohasi Год назад

Herr Marc (sorry I spent my all german vocabulary)! You really rock! Your explanation is very very detailed and self explicaned. I never understand this security topics before check your videos! Danke! Greentjns from brazil

@edwardvanhazendonk Год назад

Thanks for sharing this 3 videos, very informative and useful tools and tips! Great to have a smaller attack vector on our hosted stuff!

@OneMarcFifty Год назад

Hi Edward, many thanks for your feedback !

@dpg6769 Год назад

That was awesome Marc!! Very well explained

@OneMarcFifty Год назад

Thank you kindly!

@mihai6564 11 месяцев назад

I like the "Certificate Signing requests (CSR)" part

@electrotsmishar Год назад

Thanks a lot. Your videos are very helpful and informative. Keep up your good work

@BrunoAlves-jn2tj Год назад

Hi Marc, I am using this playlist as study material for LPIC-3 exam, is really difficult find a good material about this subject and well-explained as you did in this playlist. Thank you so much!

@OneMarcFifty Год назад

Glad it was helpful! LPIC-3 is for sure a tough bite ;-) I wish you success with the exam!

@lrlemos0 Год назад

Perfect as always!

@OneMarcFifty Год назад

Many thanks ;-)

@AkosLukacs42 Год назад

Great information, thank you Marc!

@OneMarcFifty Год назад

Glad you enjoyed it!

@user-np2xe2ri4x 9 месяцев назад

This is excellent. I am grateful

@iounios_italia Год назад

Brilliant! Thank you

@OneMarcFifty Год назад

Thank you for watching and for the feedback ;-)

@mr_trex9106 Год назад

Excellent video! Thank you!

@OneMarcFifty Год назад

Thanks a lot ;-)

@Christakxst 11 месяцев назад

Really useful !! Thanks!!!

@skeginaldp1533 Год назад

Enjoyed. Thank you!

@OneMarcFifty Год назад

Glad you enjoyed it!

@TshegofatsoTshehla Год назад

I love this content

@OneMarcFifty Год назад

Thank you so much ;-)

@boubou40 Год назад

Thank you for this video

@OneMarcFifty Год назад

My pleasure

@raunomakela9226 Год назад

More of these for sure! Revocation of the same? Use this with; NextCloud? Pfsense management portal?

@OneMarcFifty Год назад

Many thanks Rauno - I have taken note of your suggestions ;-)

@nalle475 Год назад

Nice video 😊

@OneMarcFifty Год назад

Thanks mate ;-)

@dexterman6361 7 месяцев назад

This series was amazing! I am following your videos and managed to set up a VLAN and I am kinda excited haha. Thank you :) A quick question though. I want to be able to access my home but was thinking if there was a way I can reject connections at the packet level, for minimizing issues with applications security issues. Is that possible? If so, how do I do that?

@raughboy188 3 месяца назад

Also it's worth noting that TLS certificate is successor to ssl thus more secure.

@tissandre Год назад

To come back on my comment on the 1st video, I've done some research and, apparently, SSH don't support X.509 certificate natively. But, you still can generate CA keys with OpenSSL and use the same technique to secure a SSH connection. I'm trying to generate a X.509 key on my Yubikey and use this key a autehntication for a SSH server. But I must use SSH CA and Keys instead. (Which still can be stores on a Yubikey anyway, but are harder to access) But, as always your videos are really great stuff! Thanks!

@OneMarcFifty Год назад

Thanks for sharing Alexandre!

@killer2600 4 месяца назад

Might be easier to use OpenPGP keys or FIDO keys to authenticate SSH using a Yubikey.

@naiko52 3 месяца назад

Great video, thank you! Is this secure enough? Would a DMZ (e.g. for IoT devices) still be necessary to avoid potential access to my LAN (other private devices such as my PC)?

@BS-my2ky 8 месяцев назад

Superb! Let's if you lost your phone. How do you revoke that trust from the phone to your VPS from opening your garage door?

@royagunk4545 10 месяцев назад

hi mark, have you ever made a video about Certificate revokecation? tq

@TahaZabuawala Месяц назад

Awesome tutorial? Can someone share the links of the first 2 videos of this series

@ThomasSchlimm 10 месяцев назад

Hi Marc, thanks for your explanation. It helps a lot. As I currently implement the use of client certificate in a oauth2 scenario between service now ans a SAP on premise system every information helps a lot. What I did not understand ist the need of a private key on the client side. As fas as I understand the client certificate is only a "substitute" for the identification and not part of an encryption. But ... on postman I need to reference to a PKCS12 file with the private key to get the test working. Can you explain it to me? Cheers Thomas.

@jamesmani903 8 месяцев назад

Hi Marc, The testuser client certificate in the git repo expires on 22Oct23. Will the node program work after this date? Also, Can we catch errors in the node program which can show the reason for connection refusal.

@remyzandwijk Год назад

Thanks for another great video Marc. I am wondering, how do you handle (client) certificate revocation? If certificates cannot be revoked, the application might be as well considered insecure imho. (I know, explaining it add minutes to the video, but I think it is worth explaining how it is done.)

@OneMarcFifty Год назад

Hi Remy, you are right - your server would need to be able to handle CRL (Certificate Revocation Lists) for this

@cebundy Год назад

Thank you for your helpful answer. I’m still trying to get this straight in my head. I think it’s still going to take a bit.😁

@RifatErdemSahin Год назад

green screen quality getting better with the light

@OneMarcFifty Год назад

Thank you.

@BoyanYanakiev Год назад

Great video again Marc! Is it just me that has the home network features track your video topics? :) I have a question on this one. In the video you mention that there is no need to punch through the firewall and i have seen/heard this in other videos/tutorials on home security offering different solutions. Can you please explain (in the simplest way that only you can :) ) how is a certificate better than using wireguard for example? You mention at about min 15 no VPN, no firewall holes. I get how port forwarding is different and how passwords are insecure but even in this video you talk about connection on port 8443. So how is that more or less secure than wireguard into openwrt on port 51820. Both use public key cryptography and both use fixed port connections. The only difference i see is that may be in the example with the MQTT you give the home router does not need fixed IP... but there are ways around that as well for a vpn. In a wireguard set up i only need exchange the public keys as well similar to the sign request. What is it that i don't see?

@OneMarcFifty Год назад

Hi Boyan, the main thing here is that the MQTT daemon on the VPS would be listening directly on the edge, i.e. the connection from your LAN to the VPS would be OUTGOING, not incoming (hence no whole in your firewall at home because you would connect from home to the VPS). Of course you could do the same with Wireguard, but then you would build a whole network stack around the connection while all you want is just MQTT.

@cebundy Год назад

if anyone can generate a certificate though something like openssl, how does the server know a partiicular certificate is allowed?

@OneMarcFifty Год назад

Because it needs to be signed with the same private key in order to be trusted. You can create any certificate but you can’t make the server trust it if you don‘t have control over its private key

@piyushshastri5206 Год назад

How to combine bands in openwrt like tp link smart connect feature

@OneMarcFifty Год назад

You could use band steering for this (usteer or dawn or the like)...

@simonpinkney4622 5 месяцев назад

@onemarcfifty - Very nice good job, a nice balance or techie with thinking too much about the maths. I'm also interested in PKI / x509 from a client point of view, and especially from a DevOps / API / automation point of view. Think Self Service and Ephemerol environments where I create->destroy them daily/weekly/monthly

@royagunk4545 Год назад

do we have to create a private key every time we create a certificate?

@OneMarcFifty Год назад

Hi Roy, in _theory_ you could re-use a key but I wouldn't - in fact the key should never leave the device that it is created on...

@royagunk4545 Год назад

@@OneMarcFifty thanks marc....awesome

@TecSanento 10 месяцев назад

Just consider adding Client certificate authentication to a web application with an API is often a Bad idea because you can't add Client certificate Into most of Client applications