Videos / DevOps

Episode 4 of 14 · DevOps, end to end

Certificates: what TLS is proving, and who is vouching

Chapters

1. The padlock proves less0:00
2. The machine in the middle0:16
3. A key pair0:33
4. Possession is not a name0:51
5. The trust problem1:07
6. Somebody who already vouches1:22
7. What the file says1:39
8. Signing the body1:54
9. The name it covers2:13
10. The chain2:31
11. The root store2:46
12. Serve the whole chain3:04
13. Hello, and hello back3:22
14. The key exchange knows no names3:38
15. The certificate, and the proof3:55
16. What does the actual work4:13
17. The client's checklist4:32
18. Taking one back is hard4:50
19. You keep the key5:08
20. The signing request5:24
21. What is being validated5:40
22. Proving the name6:00
23. ACME, the loop6:18
24. What automation changes6:37
25. Lifetimes keep shrinking6:56
26. Renew early, on purpose7:13
27. The classic outage7:30
28. It is not only the leaf7:49
29. The reload nobody ran8:07
30. And the key rotates too8:24
31. Both sides show one8:42
32. Identity for workloads8:59
33. Your own CA9:18
34. Everything issued, in public9:34
35. Pinning9:53
36. What it never promised10:12
37. The whole thing10:30

Certificates: what TLS is proving, and who is vouching. A padlock in the address bar means the traffic is encrypted. It does not mean you are talking to who you think you are. Encryption without identity is a private conversation with a

Mark as watchedSaved in this browser only.