Hacker News Reader

Comment by jpgvm | Hacker News Reader

I would say PKI (and especially the associated X509 standards) is by far the least understood (or most misunderstood) part of actually building secure stuff.

It would be nice if there was a dummies guide but I'm not really aware of one. Doesn't help that most of "how to PKI" on the web amounts to a bunch of unexplained cryptic openssl CLI incantations.

View on HN

I recommend Security without Obscurity: A Guide to PKI Operations by W. Clay Epstein and Bulletproof TLS and PKI by Ivan Ristić.

I started working in this space a year ago (I'm on a project deploying zero trust networking at a large company) and these books have been invaluable.

https://www.amazon.com/gp/product/036765864X

https://www.feistyduck.com/books/bulletproof-tls-and-pki/

It is combination of two things. X.509 is arguably overly complex ASN.1/X.500 thing, but that is not the main issue.

Main issue is that most people do not even grasp the concept of a certificate (ie. binding of public key to some additional information that is signed by some other entity).

Also it is a moving space. Browsers don't accept a single certificate for a site anymore, you also have to have that signed by a CA. You can create such a certificate yourself too, but as of today you will need at least two certificates for browsers to fully accept a TLS secured connection. It hasn't been that long since that rule is in place.

So it isn't only the technicalities of asynchronous encryption, there is also specific behavior of applications that use certificates to prove identities.

Reply on news.ycombinator.com