This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
Content-Type: text/plain; charset=ISO-8859-1
On 04/03/2013 07:26 AM, Ewoud Kohl van Wijngaarden wrote:
I think foreman and smartproxy will use the puppet certificate
infrastructure (as is default in the foreman installer), so that leaves=
us with a few others.
Pro for a wildcard is that it's easy. You can secure lots of services
with just one certificate. Con is that if one service is compromised an=
the private key leaks, you need to replace the certificate on all
Given we want to set up everything and still starting up I'm favoring
ease thus a wildcard.
Regarding security I hope that we eventually can use DNSSEC + DANE so w=
can use self-signed certificates (so without a CA), but also without
downsides of nobody trusting it. That will require RH IT to support
DNSSEC and much wider adoption of DNSSEC and DANE but I strongly believ=
On Wed, Mar 27, 2013 at 03:55:48PM +0000, Karsten 'quaid' Wade wrote:
> On 03/27/2013 03:46 PM, Alexander Rydekull wrote:
>> I vote wildcard if we're just gonna use it to protect our web.
> I admit to being a bit stupid here as to the differences.
> My contact at Red Hat IT (who will get for us what we need) indicated
> one-per-subdomain is considered more secure, but didn't have a problem=
> ordering a wildcard for us.
> - Karsten
>> On Wed, Mar 27, 2013 at 4:43 PM, Karsten 'quaid' Wade <kwade(a)redhat.c=
>>> On 03/27/2013 02:44 PM, Mike Burns wrote:
>>>> On 03/27/2013 12:34 PM, Karsten 'quaid' Wade wrote:
>>>>> We can get an SSL cert for each subdomain, or we can get a wildcar=
>>>>> cert. My understanding is that it is more secure
>>>>> Presuming we want the one-per model, what are the subdomains we ne=
>>>>> get a cert for?
>>>> what about base ovirt.org
>>> +1 to both (www, etherpad).
>>> Basically, anything that has a login over HTTP.
Infra mailing list
Karsten 'quaid' Wade, Sr. Analyst - Community Growth
@quaid (identi.ca/twitter/IRC) \v' gpg: AD0E0C41
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
-----END PGP SIGNATURE-----