Drive-by SSL certificate creation with nginx

Video in TIB AV-Portal: Drive-by SSL certificate creation with nginx

Formal Metadata

Drive-by SSL certificate creation with nginx
Title of Series
Part Number
Number of Parts
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Release Date

Content Metadata

Subject Area
When working with webservers it's sometimes necessary to introduce some dynamic parts in the life cycle of an HTTP process. nginx provides this possibilities with an integration of Lua. On the example of dynamic SSL certificate creation we explore the capabilities of Lua within the core of nginx.
Boss Corporation Freeware Software developer Software developer Cellular automaton Bit Mereology Public key certificate Open set Front and back ends Process (computing) Vector space Software Website Endliche Modelltheorie Information security Social class
Scripting language Domain name Metropolitan area network Online chat Point cloud Ideal (ethics) Freeware Public key certificate Reading (process)
Metropolitan area network Dependent and independent variables Electric generator Software developer Real number Maxima and minima Line (geometry) Mereology Public key certificate Category of being Event horizon Personal digital assistant Different (Kate Ryan album) Semiconductor memory Website Ideal (ethics) Physical system
Domain name Metropolitan area network Proxy server Open source Structural load Maxima and minima Mereology Event horizon Arm Event horizon Cache (computing) Read-only memory Proxy server Physical system
Module (mathematics) Metropolitan area network Email Logarithm Gradient Core dump Bit 3 (number) Host Identity Protocol Goodness of fit Process (computing) Core dump Duality (mathematics) Natural language Videoconferencing Multiplication Directed graph
Filter <Stochastik> Email Digital filter State of matter Set (mathematics) Client (computing) Event horizon Different (Kate Ryan album) File system Integrated development environment Extension (kinesiology) Physical system Module (mathematics) Authentication Email Content (media) Sampling (statistics) Database Process (computing) Rewriting Configuration space Right angle Reading (process) Writing Spacetime
Scripting language Web page Programming language Group action Weight Computer simulation Computer programming Formal language Arithmetic mean Process (computing) Software Different (Kate Ryan album) Cuboid Right angle Game theory
Functional (mathematics) Implementation State of matter Variety (linguistics) Water vapor Mereology Computer programming Number Formal language Web 2.0 Programmschleife Hooking Different (Kate Ryan album) Speicherbereinigung Software framework Extension (kinesiology) Social class Physical system Module (mathematics) Constructor (object-oriented programming) Basis <Mathematik> Line (geometry) Type theory Data management Hash function Mathematical singularity Modul <Datentyp> Object (grammar) Table (information)
Implementation Functional (mathematics) Server (computing) Machine code Code Multiplication sign Image resolution Firewall (computing) Execution unit Device driver Mereology Rule of inference Formal language Revision control Web 2.0 Bit rate Different (Kate Ryan album) Core dump Circle Software testing Compilation album Mathematical optimization Physical system Computer architecture Metropolitan area network Projective plane Drop (liquid) Line (geometry) Arithmetic mean Process (computing) Order (biology) Direct numerical simulation Point cloud Modul <Datentyp> Game theory
Process (computing) INTEGRAL Poisson-Klammer Phase transition Set (mathematics) 1 (number) Content (media) Natural language System call Power (physics)
Force Module (mathematics) Metropolitan area network Hooking Different (Kate Ryan album) Video game Configuration space Extension (kinesiology)
Point (geometry) Filter <Stochastik> Server (computing) Context awareness Vapor barrier State of matter Code Multiplication sign Client (computing) Mereology Variable (mathematics) Variance Formal language Web 2.0 Hexagon Mathematics Cache (computing) Different (Kate Ryan album) Proxy server Algorithm Email Information Linear regression Server (computing) Software developer Weight Physical law Lattice (order) Variable (mathematics) File Transfer Protocol Degree (graph theory) Cache (computing) Arithmetic mean Personal digital assistant Phase transition Video game Parametrische Erregung Cycle (graph theory)
Socket-Schnittstelle Dependent and independent variables Process (computing) Function (mathematics) Motion capture Sound effect Video game Drop (liquid) Natural language Mereology
Slide rule Socket-Schnittstelle Implementation Pay television Differential (mechanical device) INTEGRAL State of matter Motion capture Barrelled space Function (mathematics) Client (computing) Image registration Casting (performing arts) Causality Different (Kate Ryan album) Network socket Implementation Extension (kinesiology) Proxy server Metropolitan area network Module (mathematics) Metropolitan area network Dependent and independent variables Multiplication Information Connected space Newsletter Arithmetic mean Network socket Phase transition Direct numerical simulation Right angle Natural language Modul <Datentyp> Writing Spacetime Library (computing)
Process (computing) Read-only memory Network socket Core dump Motion capture Mereology System call Computer programming Form (programming) Social class
Module (mathematics) INTEGRAL Moment (mathematics) Combinational logic Power (physics) Medical imaging Hexagon Integrated development environment Personal digital assistant Different (Kate Ryan album) Lipschitz-Stetigkeit Endliche Modelltheorie Spacetime Physical system
Module (mathematics) Web page Open source Server (computing) Projective plane Bit Student's t-test Cartesian coordinate system Bit Data management Type theory Latent heat Data management Integrated development environment Mixed reality Encryption Natural language Software testing Modul <Datentyp> Bus (computing) God
Authentication Group action Information Bit Basis <Mathematik> Icosahedron Field (computer science) Value-added network Force Arithmetic mean Integrated development environment Kinematics Configuration space Natural language Associative property Physical system
Pairwise comparison Arithmetic mean Mechanism design Service (economics) Different (Kate Ryan album) Icosahedron Associative property Metropolitan area network Connected space
Asynchronous Transfer Mode Building Module (mathematics) Electric generator Patch (Unix) Patch (Unix) Projective plane Moment (mathematics) Internet service provider Core dump Branch (computer science) Open set Public key certificate Computer Natural language Arithmetic progression Social class
Domain name Metropolitan area network Touchscreen Demo (music) Patch (Unix) Patch (Unix) Demo (music) Moment (mathematics) Electronic mailing list Internet service provider Maxima and minima Set (mathematics) Branch (computer science) Mereology Public key certificate Arithmetic mean Sign (mathematics) Causality Cuboid Natural language
Computer file Graph (mathematics) Client (computing) Icosahedron Total S.A. Discrete element method Public key certificate Storage area network Mathematics Cache (computing) Read-only memory Different (Kate Ryan album) Set (mathematics) Authorization Musical ensemble Cuboid Software testing Information Metropolitan area network Time zone Service (economics) Validity (statistics) Server (computing) Code Client (computing) Login Bit Multilateration Connected space Arithmetic mean Key (cryptography) Physical system Cloning
Inclusion map Sensitivity analysis Information Insertion loss Server (computing) Code Key (cryptography) Information Icosahedron Public key certificate Formal language Data type
Metropolitan area network Server (computing) Temporal logic Ext functor Client (computing) Line (geometry) Icosahedron Limit (category theory) Discrete element method Sequence Public key certificate Arm User profile Process (computing) Insertion loss Internetworking Netzwerkverwaltung Set (mathematics) Interrupt <Informatik> Information Data type
Point (geometry) Module (mathematics) Metropolitan area network Electric generator Key (cryptography) Computer file State of matter Menu (computing) Open set Public key certificate Public-key cryptography Arithmetic mean Authorization Object (grammar) Extension (kinesiology) Reverse engineering
Arithmetic mean Server (computing) Object (grammar) Limit (category theory) Discrete element method Public key certificate Public-key cryptography Open set
Dependent and independent variables Electric generator Serial port Validity (statistics) Code Multiplication sign Bit Client (computing) Discrete element method Public key certificate Open set Number Arithmetic mean Authorization
Building Code Multiplication sign Maxima and minima Set (mathematics) Open set Public key certificate Arm Predictability Value-added network 2 (number) Web 2.0 Mathematics String (computer science) Gamma function Oracle Physical system Metropolitan area network Dependent and independent variables Weight Moment (mathematics) Projective plane Java applet Cartesian coordinate system Public-key cryptography Arithmetic mean Personal digital assistant Duality (mathematics) Configuration space Right angle Freeware
Dynamical system Presentation of a group Service (economics) Computer file Device driver Insertion loss Disk read-and-write head Web 2.0 Revision control Mathematics Escape character Software testing Information security Physical system Scripting language Service (economics) NP-hard Mathematical analysis Arithmetic mean Process (computing) Oval Search engine (computing) Configuration space Natural language Physical system Reading (process) Spacetime
Metropolitan area network Email NP-hard Information Multiplication sign Projective plane Code Function (mathematics) Disk read-and-write head Web 2.0 Duality (mathematics) Sample (statistics) Integrated development environment Radio-frequency identification Lie group Software testing Information Parametrische Erregung
Demon Robot Code Multiplication sign Uniqueness quantification Moment (mathematics) Projective plane Representational state transfer Web browser Open set Disk read-and-write head Public-key cryptography Public key certificate Web 2.0 Sign (mathematics) Personal digital assistant Website Point cloud Software testing Quicksort Condition number
Freeware Software Open set
welcome you to my job and prior classes a certificate issued by by SSL certificate it creation with the genetics and in doing this so you will see what I mean by this what I have in
mind about an what what was entities agents is capable of and 1st of all about me and on working world hosting companies that means it's a little bit and we are compared to German market quite small but we have been the top 5 so it's a little bit more an every this vector of 10 small and it's a little bit I'm mostly that and development of the model but the security of stuff there that's why there was seldom cell will have to pick something website that's not but as part of my the so the you but not mine and if 500 the URI in here all talked of those in coastal management and if you have questions please boss right away and then don't hesitate to weighted here of to talk and I came across the
capability of mentioned it when it lost so many many Cloud flaring 2004 to present the 40 announced that they give away free SSL certificates for all and explain what they're doing and then a followed along the engine experienced in the and because we used within the weather was in common with other work
we use engine extend the capabilities that the script capabilities of thought that would be nice having such a the that up yeah and recently there was a pet contributed by CloudFlare and this talk is about respect and the possibility and what this example shows it's like to this year is 2000 15 and you've crossed column as a as as a certificate that only for the specific domain has no sound or why because certificate with read issued certificate every year the same goes for all the furor past provided with examples like maybe some of you know and slack as a as a chat programs each
company has its own subdomain and then I guess what they provide is a white part certificate would would be really nice is having a
certificate on-the-fly generation perceptibly it didn't start out of all the idea behind and so I will introduce you to steps to build such a system if it's reasonable I don't know it's it's more a technical challenge that uh yeah it's morally it's not a real use case but it could be in the example of that it's a good example that about engineering and this written spelled the it's it's an old pronouncements spelled it's a different thing and Benjamin's itself it's so if you are familiar with little to is more on the developer side and whose MOS is all the more the developer's site but it was the response was or stuff and deploying but again it's like the majority and then I don't skip this quickly I guess you have you know that the 2nd most used but so what and in these properties are is high performance and low memory footprint is a wet cell is also proxy along the lines of thinking caching you can do
catching it seems to me worse and worse and 1 . 89 you can also do TCP and a proxy that's a new feature that they introduced in came along with the h a proxy and the whole system is event driven and having such as so he considers design it started in
2002 went public in 2004 now this is wrong in 2014 engine expelled from the company was built to have a professional support the open source domain this engine is the part that commercializes actually to from FIL golf and
it's like that and he's like he can do a lot of things that he uses gradient and he's established and yeah
I know he has all the good benefits and features but what makes that and that men really really a superhero is that he has a lot of accessories so
that he can use the same applies to engineer sensing engines as quite small core and Unix's intercourse capable of like doing it should be stopped as little stuff but not much this little bit of lobbying and be the global land but in the ecosystem around and genetics article accessories people build in modules
written in C to extend the capabilities but all the belt of engine exist but a few examples at troops out really why what west if you looking at that at the 3rd party modules is bond and stuff you see stuff like in the dual problem extractor or up process that's actually quite often use or a simple gift that friends between gives all demand resides in the drizzly so is also a thing that often use it into my and the possibility to come to talk to my school leaving the engine makes scope and talk to writers as well and another thing that's the molecular and here's a little example that's actually 2 different third-party
modules is 1 is the echo modules that you can write that's not allowed in the core and introduce turns the value and the other 1 it's a it's a register an extension because the diverse almost she didn't build another 1 in and you know uh and no know and to do with this is that with this example you can set and different the different very directly to red is all read and then do some dynamic plead with that in a globalizing or configuration stuff and other thing news engineers because is event driven and it has different faces of different states during the burn during the start of a lot of HDP and request and hand handling and the image of and there are some steps in between and left them out because they're mostly pre and post stuff configuration reading rights that with the bonds among other re write things and in this space you can you could apply like the different rewrites Hollinger needs is is behaving exospheres so that it's not what you know about it should be authentication and try tripods is looking into 5 systems content that is is it is delivering content out of different file system database different and locking itself after the process is done it's deadlocked and then you can apply filters if the request is like at the stage where it can push back to the to the client you can do filtering of the header and a body that was my
example you can see it's it's like sample it's in the content based and this and this set is that is actually in the rewrite this and that and if you look if you right there see extension you have to decide in which event you put into the engine score and what are the what are the chances you're applying and because of different modules that can there you can sometimes but stuff for a lot of people and then
better would be nothing without robbing a it my job is you well
actually is a programming language and blue eyes
fast by design not not by design the because it has a very very light weight assigned it has a good example is learned Lu 150 minutes that's web page you can you can if you are familiar with programming with 15 minutes I can assure you you are capable this this and that's is so easy that things yeah but embeddable inedible is 1 of the features that that could was famous for means that for example far cry and a lot of gaming engine have the possibility to the right right malt modifications you want expose different modification possibilities and you see but and that ability also in in in the automotive industry where you have simulations and the group who can OK and the was used in in network switches as well to do a 2nd filtering and on the fly and with the DVD scriptable language possibility to other boxes that
that's actually from the 15 minutes it's not the whole bar but you see this and this is why the easy you have you types here is the numbers are always doubles and then you have double singing quoted the line you knew if you knew something it's goes a garbage collector of you've loops and if-then-else and there are some other constructs you of water with you know from different programming had hashes of various states that have tables that have no class support like object orientated you can do people do stuff but it's no rich functionality it's mostly parts of the procedural then programming and
aimed at the end of the room blue eyes as well as a lot of accessories and Luo comes with a rich variety of different modules that can be written in in the blue 1 or in sea itself and in what I mean by that is it's it's a good example for this is that NEC and web framework that's entirely written in well that you can use them lieu of 5 system it has and C extensions to hook into their yeah 5 system itself and see Jason as well and it's like you see chasing implementation exposed to and what it what you also have been done in the the basis and will rocks Merox is here in if you're familiar with it it is installed OK and PM all these different package manager in every language
it's it's quite limited compared to tools that are so but in most of the time it works it works because people are not depending much on each of those modules like like you the thing that you can see the Telstra community like 2 lines of code is signal molecule and everybody inherits this 2 lines and and then you need like circle dependency rate resolutions insulin and conflict resolutions blue eyes only little part of this and it was a newer rock-solid you rocks is capable of light that compiling the SC-based coded by then I think that if someone shapes uh see embedded it's blue well functionality and fewer Roxie to if you have to write dependencies on you always operating system and then you could the so this module and as always and there's also language but undercover account where the some of them where they have a lot of summaries about different different tools and stuff about physical system then there is a new object and because of you which it was started as approaches to because the core order that the language itself is so small and and and guy and remember his name started until you would cheat project and now you have the possibility to use you all you watch it as the game cheats for testing time compilers says it is saying it's like if you run this cold it continues with it's optimizes on the fly and a lot of code is very useful and for example for each unit in the web server where you have and what they would like to apply and then on the web publication firewalls like these rules have to be run over and over and over again and they go get their hearts simply get hot and they optimized incompatible tool to machine code and then the running they say 10 to 100 times faster than the normal what implementations itself and 1 of the main drivers behind it this cloud in the cloud as well because nowadays she around 10 per cent of traffic 1 and if they could optimize was achieved by I don't know 5 or 10 per cent gain a lot of capable of him capacity and think of what it's like Robin on steroids it's like and that also the
nice part about what it is it's compiled on nearly all systems and all process architectures and has binary-compatible means that you can switch from what you were cheated in in it has the same syntax and it works yeah but it works also on piece reappears for which is quite nice
and 1 thing to remember all to take away the and they are robbing and then later or engine it's in lieu of robbing and that 2 heroes and hands with the community with tools behind it and that's the foundation a safe street but but in that
that's not enough for the other engine makes any of you are now we go we go that apart
where these 2 are combined and now we are at that and genetics you was or http well module or the other and you can also find influence and it's when you that's the rest of that actually that that the lower and the package name that's the name of the documentation and that's to keep up name it's kind of confusing if it if he searching for thing it's all the same there and what it means it's like embedding the power of the way engine genetics here is a small example you you'd like to get the call the continent by the way means we think this brackets you right normal you were called and it's getting to Britain and you can it and it's pretty printing out Hello World that's basically the thing that that that's the integration you a lot of these you have in by you you need to work on immediate surrounding ones when the starts when you master comes up that you need workers is very very master process and you process you set by or in India in the previous example of you seen set as the direct people managing now you can dynamically set things in the scope of engineers rewrite excess content Locke had defeated the top and bottom the use this this this these are the phases where
you can hook into the engine makes and modified by itself and they gain some attraction because you saw this 1 wild west of C modules and people started migrating very cold into the world because the burden of named and you extension in changing mentioning Skull Wars too difficult or too time-consuming compared to you what that that's always stays the same or more or less the same and that's the reason why using see nowadays a lot of modules and then stuff moving into the well world the old stuff from with doubts or is dying of and another thing that is possible is a new way of life the Masoretes by you will find
that means in the difference here it's in the you you write is directing new engines configuration and you
can specify some specific you will 5 and I've I always would recommend way because you can't see the burden that you have with a couple the quotes within within their entities from regression if there's a fixed on the way but it sometimes and there is also another benefit
the see it's said you will code the lower court nominee even if it's invented by and by you will find will then it's compiled thing and then compile the data into an optimized way and then it's always interpreted from optimized weight during development this is this is every single character that the change in the 2 of you find you have to reload engine to get to get the updates but in the end you make that's 1 of the traits that you can do it's that you know that during development to disable the cache and then you can edit right away and you always see the new office in if you request hits it's This is Luo specifically directed directed the very and another thing it's then these are parts where there Lu mentioning some widely items in meetings within the scope of of the what you have to talks on how to the web server meaning that needs so mean API to talk to the outside world of engineers and the 1st thing is engineers architects something like you have on the consul the best way to store or in every other languages like paramaters paramaters passed in their songs so in situation where this happening for example set by you or it can passing parametres or intervene filters but there is but rarely the case that you work if there was a time you were preventing flowers and a good example is outside Morris always has to be out of declared outside of the US meaning that during the life cycle of a request you could change the values this is very handy if but for example at this point I'm going to approxi onto a proxy the upstream and defined a barrier novel variables of the proxy and being well code you could do health checks or you could do with global lensing or intelligence that intelligently local and algorithms and so on and so forth if you if you set the variable in the in the right face new then engine exist performing like proxies we this modified and which is modified so variable and another thing is engineers had and it's used to read and modify headers depending on the stage if past them if you passed that there there if you passed the law face you know able to modify them anymore and and imagining status is still 80 degrees status that's that sent back to the client and engine context is also and it if you have to pass information between so faces meaning you have to rewrite phase the derived from information extracted from the information you need is on the on the continent faces begins to context that means if you feel familiar with Android it's like you you on the Android system if if you switch to you you have to do you have to assign all the information on the context and then switched to you otherwise is information them are lost and that that's quite handy if you if you passing states or information and along with different faces is that clear but that the and other
things even the lower API engine needs you I API part of stuff we saw like and genetics say saying tenders and and and so on and so far forth and you could do redirect effects to some request and might come to this later and goes sockets some example about this to
an engineer capture that's a nice thing what you could do it said and you could do life advanced it could be checking off spent checking in this example and what we what we are doing it's like we're capturing during a process we do a sub-request with engineering and waiting for the response and then we interpret it as this this is like http
request within http request and you can do even you could do to pull multiple air captures and there's a book capability of doing paralyze allow capturing and the output aggregating the information contained in and that's a a useful example for this would be if you have a central locking so you could always use and internet as a proxy and the his checking against this log so what are these credentials sent by these clients of value in the uh here for this reason I am elected past otherwise and I tonight Texas in example that I used to implement was like MailChimp newsletter and wanted to have a cast a newsletter and subscriptions for anomaly so what I've done it like posting on my own website capturing this stuff with engine extension the male trip cell wall then we if the API credentials attached they are actually within the invention and then I modified response that I can we have differentiate between different barrels from things these other kid that these are the possibility that you could do there was capture that another thing it's a cause occured IP it the thing
about the engine makes within these phases is everything has to be non-blocking and that in the West the thing that well so you're normally you have you have to use a new well modules and this then for example a agent we already saw an implementation state uses of the blocking socket meaning if you if you used to be if you use this library of in engineering it's not gonna work because and if the request comes in and then you blocking while waiting for writers to give you an answer every other requests has to wait until registration and so and for that reason engine is compressed soccer was introduced meaning given the user the possibility to do non-blocking socket connection TCP connexion the connection as well and but at the end of March space on the slide but you what you do that you have to do it's implemented prodigal on top of the sockets meaning like here and the nice thing about this is that you can use keep-alive meaning that if you're not closing the connection if a new request comes in 3 users to keep a lot of connections that's and if you need to but you have to to gets more performance out of it good example of the red man can cialized oppose integration the Unisys actually had UDP and implementation and for what the look like it's like you include a right and then well right these clients that's crafted for for and genetics all work with engineers and then you do do you know more knowledge about the manipulation reading writing and then there are
lots of more stuff than and that you could do this engine makes and you want have for example an in-flight threats and you can run and so on work offloads I've seen people doing topic you engine makes that says that the funny thing because if you have indeed by work you could do things with this part that and there is this is it's a strange thing with the light friends they they'd actually work but yeah can somehow scary yeah and GMM exists and meaning that the because you've and 1 master process and you have a lot of form worker processes I don't know you could share caching layer and all this and work processes meaning that yeah and that's and that's the reason why there are also basic hashing algorithm with enough to get to to help with the cash also recognize this directly in the core for modifications and stuff that's basically and there's so many the yeah sometime in leading things that I have encountered that they're they're out there but but it's not class it's it's quite small the but you have with this capture and the call socket thing you could do with that and
meaning that if you combine these 2 you get that that will be kind of cool it's like he eventually and then you have to do what you could do with other programs but the problem is and and you
have to be alleviated in module you have some people lose the road on the top of the red is integration some people wrote in my school integration and that's where open rests a kicks in open resting it's actually a combination of engine makes you want to do that and they used to achieve they could also used it was well the engine makes you want meaning that integration the rest while modules and the lips meaning like that aggregating a lot of stuff for meaningful to community and petty in in in the right space that you know that that
that that you have a rich environment that you can start with and the normal makefile that's very handy it's you downloads them open rested make making so what is suing in the background it's more or less well 1st of all the apes downloads silhouette to compile and that's it in an engineer makes combined with engine makes and as engine we've so so that with all the different CD module essentially the models and the well modules and then place it on the on the correct system the thing that's not happening at the moment it's it's there isn't at the moment no this topic which is what I you normally do I feel this topic is reserved and not that complicated and I really touch with the creator of don't rest approaches and but he's so busy at CloudFlare case I guess I have to contribute stuff and the other there's also talk or image existing back and you know that but if about the rest the
modules it's them resting modules as you saw you have modules coming from and genetics extending engine it's gone you of modules coming from the White standing then you will modules we flew out to was C and the rest the module is it's it's always a mix between I don't know it's if there if it's also a little bit like west of arrested project tried to like it only include modules so that that that that well maintained that work that tested and actually the testing of all the rest is quite impressive if you if you ever go on open resting webpage go to Q a couple resident or but didn't have heavy testing here and that's the reason I never had any issues and then focus rested in our infrastructure um another thing is if you have to installed things that are not born with all the rest in peace use Luo rocks and install it on 1 specific class and we've been engineering students can includes the specific type of rocks and into your the current environment and then use installed in it's and it's not very easy you have to get used to it but but once you use it you you you you you get it going
and then if you need a BMW and take Hong Kong is actually as open-source project from Mashable it's kind of to God they do a lot of API global and seeing the odd indications of and what they build college micro-services API management layer would actually 2 kids because of rest the has as the things that you can build you application on top of it what they actually done it's going to be a step further and then to for example what they included these so is essential and again looking layer or charity the decryption layer along the 4 central locking cell wall and the
meaning that there in ever-changing environment you know you have the API that you can manage you and genetics configuration that's kind of the gage field you can add s association and host the kinetic authentication information can local and chopped something the endowed with the uses a Cassandra cluster on each node and to the information of charity this is the best you if you if you need something and endeavor blockable assisted system meaning that likings like everyone at 2 months to bring out in you the new plotting that you can enable or disable little bit of configuration and then you have the new API endpoint American men and that's kind of a group calling it the and decades of attraction in in the in the in the Microsoft stock community because it said that the big deal to dynamic dynamically the global ends things without changing and use them configuration
1 of the things to take away is used ready built tested solutions uh looking at open arrested and if you'd like to be more on the basis of Oracle if you if you'd like more or less
production-ready stuff you I think the fast lane compare and in association with that man and dropping the fast lane of crime prevention and now
to the seeing of my talk what I was thinking or what I have too often and active in the open radical munity we use it within our the company for different services and recently there was a there was a catch about SSL by the
way meaning that they could earn ng that was secure your SSL connection controlled by the world body Batman and Robin they have the same problem recently they were attacked and now nowadays you have to introduce new mechanisms to make them safe again on the following
the this is actually a
patch of snow alright now we open the rest of it to be to be as I mentioned that critical progress is quite busy at class that and what newly introduces SSL certificate by are and has a certificate but it find what it's actually doing it it it it it's a step before processing happens in that he could to and as a central generation as a certain delivery and was peace checking make and and as I have a discussion on the issue of 331 all the opening a prestige project that best at the moment is there's a branch you can compile it and what what I've done I took the branch and I'd have to build stressor project is doing all the computation and stuff and swapped out the opening rests at that so it because open arrestees downloading away genetics module I sold out the use the style node with the download of this branch and or
what I had to do it's like at the moment you have to patch changing cause well because open rested downloads engine score downloads also day in wine genetics module and what I had to apply its like changing the the branch in the download and penchant engineering school before it's built that's that's the thing that you can see all that tricky uh you know and the thing is followed by a cloud of and meaning that they're on the same side 2002 13 of 14 either no you needed it's definitely but battle-tested that's the thing that's driving there as a set of 3 . trustable but actually doing is that that part not to refer see you and 2 of its global sign and what they are doing it's like combining a lot of domains and generating some certificates and what they have to do internally if if a domain or as they only support as snide if S and I repressed promising they look up in which certificate which certificate belongs to these list of songs and they have to fetch Don the certificate from the back end and because they have like around the 1st tee 240 dataset because they have to do this this this and a distributed them and they do it on the fly otherwise they had to they have to send a lot of this is a certificates across the globe meaning that if you divide it now here uh CloudFlare being things that it's not that's not having license certificate it's good fetched on-the-fly and kind of in community and I was inspired by this and then I can show you a demo about what I've done here the but to say think for switch to the other screen we will my set of is the following i
have in their boxes running
it is by the bigram box
running avenging sense my and there are a lot of kids to it's if I requesting fire in that where you obvious sorry for the and when I actually
what I'm actually doing is the following this will is working on I opened S is client connection to Logan most giving someone in meaning as an I connection test don't drive by that's the giving see you find meaning that the certificate authority files that go for validation meaning checking the certificate that I get better if it's if it if it if PCA and sign this certificate and will and what we see here it's it's verified by the fication change and what I and dynamically generated by Luo and so that they the a because of time zones so that polishing and individual books that actually needed to almost the only difference is that if I hit it again and meaning and I could get get to same but with a little bit later ballads 44 and the see any of the commonly used I change in a new it
take the shore then you can
update their information here for an if I'd passing another subdomain sub belonging and 2015 example then I get a new name as the name many of the certificate is valid but the the genitive engineered score generated on the fly as the sensitivity of the languages and is returning same and I can show you with a fresh Firefox probably work with Firefox
and installed a lot of things over if you in this you know 1 will be
we no no it's and the thing is that I know this stupid if I connected to the Internet and the thing is that I have the last entry within the genus Must they're set up within the network manager and that it if if I don't know connected to the Internet and the here's last within the limits of it's not responding that's kind of about you know but but what I wanted to show it's like what you could do on the French in installation of Firefox sequence and the certificate of origin and a new certificate and then I can go to every subdomain and negative it evaluates process certificate or no no warning as an example clear what I wanted to show the there are no lines
well they did actually
called the in the reverse so about them when starting at a point in the the codes in
a well oriented and it looks for like this you 1st of all I include module for SES is that that's the that's an extension coming from this as a the then I need open SSL Florida whole certificate generation key-generation so PG means like this public key cryptography and then I will require let's see is the certificate signed request afterwards I loading the CA meaning the certificate authority the and certificate and nodes the thing from the file into an object that's actually death certificate then I could do manipulation on the think the same happens to the key of the of the authority because with the key off of 204 authority you have to sign the newly generated to and the newly generated state T. certificate and what I've been doing if it's not there necessarily so when meaning if it's not that it's not
as i if someone could not within s 9 it so if we do we drop out because of this limitation then I start with a
new the certificate request meaning this object that means the region generated by adding and you see here this is actually the data it's always included and the from less than 90 days in 90 will be the so called calling and what I've going to doing generating new public and private key pair for that but it was 4 . 4 the new certificate afterwards I assigned key to this certificate that generated a certificate request this certificate the request then and
0 from the certificate request a new certificate is issued actually had to change because Firefox is blocking that this is this is this year a number of meaning that the value the certificate authority has to increase the number of the serial port each certificate issued 5 houses that is excellent checking this and I had to do this morning a little bit of hacking to overcome this issue and now it works it's not actually to to the code on the on the on the on the so not the same and a little bit modified above it it's more or less there in the same thing and then as at the time of the validation time and what I didn't do it slightly taking a this is what the name is wrong and this the meaning that the client certificate on the certificate is assigned with the she enters the certificate of that of 14 and here is that's actually where the magic happens I guess Indian CloudFlare it looks like this the thing on the topic is that the generation in signing somewhere offloaded and its meaning that the only thing that they do on the fly is capturing the response and a certificate on the fly and
setting and cashing in on the local so what what what what would we then do it's clear the certificates that we
and had to sit the engine and configuration set and certificates the in the in the formant of that their meaning a binary string and I only yeah converting a binary string to say that the certificates into a binary and the same goes to the private key of the of the public so the same goes for the for the private often you generate a certificate that's all the things that you need to do it's wrong it at the moment it's a little bit of tricky to get everything right but I think in the future you see a lot of applications my 1st ID was at the moment if you all heard about let's conclude that the initiative from was the Lotka my Cisco they tried this the building automated system to get you free exercise certificate and my initial idea was going to announce to them and was seen as a way of generating and then it's public and certificate usually usually on-the-fly meaning that every time someone hits so I get it instantly but it certificate I never have to think about reissuing stuff everything I can write down into the well what if someone hits the 1st time he has the weight either 2 seconds off or something and or I don't know meaning that the request response about the request afterwards it's OK then the oracle dual Krongelb that that is doing that every nite yeah that that was the basically at the moment when implementing this for our web hosting customers and during this work with so that that that the API is that the case is changing to radically that I could adopt these changes all the time for the talk I had to get started with the adoption and I ran into the problem the day but actually that
that open access project had a lot of issues 1st of all I had to fix a lot of the code issues within this project before I could go on and that's why we have all simplified where
and need the and the securities and security in is 6 curing in ever-changing system is hot but it's also possible so that you can introduce like security labels of dynamic stuff on on the web so what yeah that the 2nd driver don't produce going on
1 of the pitfalls that I learned and during my years and also prepared for this presentation if you do a lot of engineers configuration thing modifications these always run Service engine called the test had that sometimes the issue that I thought and I had change something made reload but that but actually if you do worry you node and you have conflict issues mentioned is doing nothing and say nothing to say nothing about its like and that's the reason why I always do search engine it's complicated and then reload and the same happens so if you do a lot of conflict changes as the when changes a little small Python script and if the file changes I analysis of aging to the cell wall and then to a convicted and really to sell that might also fell into this trap like this characters in the world process or yet another not very intuitive but better than better than it will be and and as I mentioned always used to about 4 and 5 it so that it easier to handle with no escaping if you would like to read post losses in excess space meaning like 1 of the rewrite like face then you have to do an additional and request head body meaning that in the face of we rewrite and excess and genetics has not yet
loaded the and then the body or the posting and it's and drink the debugging in engineering environments
western dynamic ingenious environment with the wide In all use your actually hard and there was very many times like the little pieces that Tier 1 of the things that I often do is like betting debug information to the header information in like aggregating information you could lock all the information about the thing is under undeveloped sometimes under this is always had so much things and what you could do have special texts and if I specified is hidden pair gets me like and debug output on lifestyle so a lot of this kind of cool me tric of what would you actually also could do with like generating a a trace and dressing ID and then piping you know or keeping this trace idea as a as a head of American parametric to the web so and then name going for your locks that's also a possibility but I found that engineers had the bound the easier and if you're looking for a coach Our useful example actually project has very good tests and then put it as
a talking head to look many times with them in the code because it's at the moment is not yet documented that there something conditions where the documentation elect yes and I'm at the end of my talk and thank you for listening are there any questions regards sort concerned about the stupidity about this project yeah normally what I do now it's it's kind of a silly example I generates for each requesting is typically it's kind of stupid it's not of the it's not but will what what you normally could do which offloading money and as I mentioned people doing worker demons weaving engine if he could do the same thing if the 1st 4 test pizza so what you can't to work on then it's been it's in his own worker and it's not blocking the other requests yet and you can do not on again over no there are on tension issues meaning that I had to World permission or if is for the CDA therefore the uh the MCA certificate that give permission to that to that to that nation's yet but normally do this using a secure back and then it yeah yeah yeah you have to be and for that reason I need private key to sign otherwise known unknown my my using yes this use case yes but they use case of let's include for example I'm going to introduce bacon and they gave me an s is a certificate I could also program that I log to the complicated website and the web scraping of global sign or something else that's that's not limited to this because if you if the capabilities but for for this purpose because I'm not CDA have to treat with the browser to exactly as as you but the initial idea was going to efficient since where they have the REST API WebKit where can issue OK so far blowing ask it to end their so it's in the H that's the guy behind
uh all the rest the stuff and clouds Florida contributions and hopefully we'll see some of you in the open rest and unique silhouette community thing around thanks so much


  438 ms - page object


AV-Portal 3.21.3 (19e43a18c8aa08bcbdf3e35b975c18acb737c630)