Empowering X.509 Certificate Management with Python
summary
Programmatic X.509 management with Python uses the cryptography library on an OpenSSL backend to build CSRs, sign certificates and run an internal CA via REST/Thrift. Code examples show generating RSA-2048 keys, signing with sha256, issuing short-lived certs (Facebook uses ~24h for user, ~1d for services, weeks for hosts), random serials, and starting validity an hour early to avoid clock skew. Servers use ssl.SSLContext with mutual authentication and verify_mode required, plus logging and revocation hooks.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:35Understanding X.509
- 1:40Why move beyond passwords
- 3:37The certificate lifecycle
- 5:20Building an internal CA
- 8:08Programmatic management
- 11:05Developing a CA client
- 17:48Implementing mutual auth
- 21:24Integration with services
- 23:53Best practices and tips
- 27:25Q&A session
related talks
34mPython bad cryptography habits
36mYou Like It Or Not; You Need It! - PKI And Certificate Management
21mCryptography at Scale: Building a Practical Cryptographic...
16mJust trust me - public key infrastructure in less than twelve minutes
30mCert-Manager Beyond Ingress – Exploring the Variety of Use Cases
35mCooking with Cryptography
48mChain of Fools: An Exploration of Certificate Chain Validation Mishaps
26mcert-manager - Past, Present and Future