veyepar: Managing internal PKI system at scale with Anchor

Author(s):	Stan Pitucha
Location	Wellington Room 1
Date	jan Thu 19	Days Raw Files
Start	18:35	First Raw Start	18:07
Duration	0:45:0	Offset	0:27:01
End	19:20	Last Raw End	19:21
Chapters	00:00 0:02:55 0:32:55
Total cuts_time	45 min.

http://linux.conf.au/schedule/presentation/97/
raw-playlist raw-mp4-playlist encoded-files-playlist host archive tweet mp4 svg png

assets release.pdf Managing_internal_PKI_system_at_scale_with_Anchor.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:
Locked:	clear this to unlock
Locked by:	user/process that locked.
Start:	initially scheduled time from master, adjusted to match reality
Duration:	length in hh:mm:ss
Name:	Video Title (shows in video search results)
Emails:	email(s) of the presenter(s)
Released:	has someone authorised pubication
Normalise:
Channelcopy:	m=mono, 01=copy left to right, 10=right to left, 00=ignore.
Thumbnail:	filename.png
Description:	Managing Public Key Infrastructure for internal systems is hard. Manual approvals, revocation lists, renewals are all more complicated than they should be. I'd like to show the Anchor project created by HPE security to simplify the process for issuing certificates to services and systems. It's very different from the usual enterprise solutions and close to what Let's Encrypt has started recently. The main reasons behind creating Anchor were: - revocation as it exists on the internet today doesn't really work - certificate expiry / renewal is hard to manage and often forgotten - existing PKI systems are huge and complicated - OpenStack deployments needed TLS on every service without depending on big PKI system - it provides configurable validation/authentication of requests without involving users I'll explain how Anchor solves those and other issues. Anchor is currently used in HP's Helion OpenStack project and is one of the official OpenStack security projects. It supports standard X509 and simple CMC requests. It also integrates easily with common authentication backends (local, keystone, ldap) and can sign certificates either locally or via PKCS11 interface (this includes keyrings, hardware security modules, etc.) markdown
Comment:	production notes