Cryptography on wporter.org

Setting up Cockpit with Certbot and a private CA with an ACME endpoint

Wed, 09 Jul 2025 21:35:00 +0000

This is an excerpt from my step-ca post that I felt is useful enough to have its own post.

I have a server running Cockpit that I’d like to use a valid SSL certificate from my CA. I’d like it to renew its own certificate. Let’s do that.

First, be sure to install the root certificate on the system. Since this is a machine running AlmaLinux 10, that looks something like this:

Building out a signing certificate authority that supports ACME with step-ca and an OpenSSL root

Sun, 06 Jul 2025 21:35:00 +0000

This is part two of a multi-part series. Today, I’ll be configuring an intermediate CA under the root CA I set up in this article.

step-ca is a modern online CA for automated certificate management. It’s got reasonable defaults and is fairly easy to use as an intermediate CA for smaller environments.

To learn more about step-ca itself I recommend a trip over to the step-ca docs at smallstep.com, but the highlights are the simple nature of the tool and the variety of built-in automated provisioners you can use (like OIDC SSO tokens, ACME challenges, identity documents, and JWK tokens). It’s also a decent SSH CA.

Using OpenSSL to generate a root certificate (using OpenSSL on a Linux server as a root certificate authority)

Wed, 02 Jul 2025 21:35:00 +0000

Introduction

Certificates are often viewed as “black magic” - and, as with any cryptographic topic, that’s entirely true! Cryptography is great.

Thankfully, you don’t need to be a cryptographer to use public key infrastructure (PKI) to establish trust between systems.

If you’ve ever created an SSH key pair, you’re already familiar with the fundamentals! SSH key pairs and SSL certificates are extremely similar.

In a typical PKI setup, certificate authorities (CAs) act as the trust anchors. You can think of a certificate like an SSH public key: you distribute your public key, and devices that have it can verify that you - holding the corresponding private key - are who you say you are.

Why doesn't Windows support modern cryptography?

Tue, 01 Jul 2025 19:35:00 +0000

Try to feed Windows a certificate with an Ed25519 signature somewhere in the chain and it’ll just FALL OVER because CNG doesn’t support Ed25519 AT ALL?

This is an operating system that is ‘modern’ and ‘current’ and ‘has AI’.

Here! Watch it fall over when I try to do anything with a cert:

God forbid you want to use something with an Ed25519 signature in the chain: