HashiTLS: Demystifying Security Certs
summary
Explains what X.509 v3 certificates actually contain and how they fail in practice, cites a 3-hour outage from mis-rotated certs and a recent Nomad CVE caused by incorrect validation, and shows the exact tools and commands used: OpenSSL, CFSSL, and mkcert (mkcert backdates certs to skirt the 825‑day/Apple Mac requirement). Demonstrates building CAs and leaf certs, bootstrapping Consul, Vault, and Nomad with mTLS, and inspects the code path that enforces checks via verifyPeerCertificate and TLS client name verification.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:17Microsoft Teams - 3hr Outage
- 4:21Certificate Basic Fields - 2/3
- 8:00Let's Look at a Certificate
- 10:13OpenSSL Command
- 11:50Version
- 12:25Signature Algorithm
- 13:42Validity
- 14:51Subject Public Key Info
- 15:24Extensions: Key Usage
- 16:04Extensions: Basic Constraints
- 16:35Extensions: Subject Key Identifier
- 18:23Certificate Chain of Trust
- 19:19Cryptographic Protocols
- 23:22Serial Number
- 24:05Authority Key Identifier
- 24:22Subject Alternative Name
related talks
23mMaking heads or tails of TLS certificate errors
44mSSL/TLS for Mortals
27mDebugging TLS/SSL
46mMastering TLS, OpenSSL and Certificates
36mThe Art & Craft of Secrets: Using the Cryptographic Toolbox
42mLet's go HTTPS
46mSelf-Signed, Why Not! Exploiting Insecure Certificate Validation In iOS And macOS
31mPKI the Wrong Way: Simple TLS Mistakes and Surprising Consequences