We have started with our next tool.
Hello. Welcome to Agnes Certificates with Free IPA.
I am Senior Technical Account Manager in Dreadhat.
My colleague is José Ángel de Ustos. He is Senior Specialist Solutions Architect.
Also at Dreadhat.
Here is the summary of what we will see.
We will start with another video of Agnes Certificates with the data.
We will see the features of the protocol.
We continue with Motem Deklayan. We will see how to do this client, the limitations,
how system D can help us to manage all this process.
We continue with Ademo with Motem D.
An José Ángel will continue with Sermanager.
The demonstration of Sermanager and finish with Conclusions.
In 2024, Digital PKI and Tras reported approximately 38% of organizations
are using manual procedures to track and manage certificates
and updated on legacy methods.
In this case, a lot of limitations that we already know
like is an efficient process. It is also so much complex,
and time demanding, and they depend on the human error.
This can lead us to a significant impact,
and painful of that, as we know.
For example, we can discuss a lot of trials,
but reputation or availability of services.
Experts or locations are hard-significant impact,
and Agmecon to help to solve all these problems.
And it was designed by Internet Security Research Group,
for their free CA, that it's in clip,
and it's enabling the automation of issuance
and running well of certificates.
It has removed any kind of human interaction
and all the human errors that can be introduced.
Okay, traditional process to manage certificates.
It's a very tedious one, and involves a lot of steps,
rights and rights CSRs, who meet the same two trusted CA,
through phone issues, via manual domain validation,
waiting time for the CA, copies, or to server, install, validate,
monitor and track, bring you, and start again, all the process.
And the Agmecon price by two parties, at either server and client,
and will perform all the steps completely automatically,
and these are avoiding all the manual and processes
that it's really a role-prone.
With Agmecon free path of taxier, you can deploy an automated pay-kai
with low cost and let it be a very little effort.
Free-bound with Agmecon provides in short life-time certificates,
that by default are three months, but are configurable.
And this is to be in line with the free open source,
let's include profile.
And I'm now using a challenge on response authentication mechanisms.
Mechanics to prove that the client has the ownership of the domain,
is can be done via production of HTTP resources on the origin,
or via creation of a DNS record,
which is to prove that the origin is legit.
Now, José Agé, we'll continue with overview of protocol.
Yeah.
Thank you.
So, request must be authenticated.
Because who has taught me for requests of certificate
for a first-end.org organization?
An impersonate that organization?
How this is done?
AACM protocol incorporates two challenges,
one-basin dinners and the other in STTBS.
We're going to see the STTBS,
which is what's similar to the DBS.
So, the entity using the certificate is the ACM server.
And the one requesting for the certificate is the ACM client.
So, when they talk together, they interchange the public keys.
So, the server creates an ounce,
a specific information who sends to the client,
then the client encrypts this ounce using its private key
and exposes this specific entity file at the domain.
For instance, a sample.com here,
then the server gets this entity file.
They keep this using the public key for the client
and compares with the notes he sends to the client.
If both are the same, the chance is solved.
So, the public key for the client is authenticated and validated
to ask for certificates for the domain.
To ask to renew and even to remove them.
The revocation is the same,
because the key is the public key for the client has been authenticated.
So, he performs a request for revocation
and sends to the server.
The server validates the key and then revops the certificate
and includes this certificate in the serial
just all the clients for the site can check
if the certificate is valid or not.
So, now my colleagues will introduce you
about the FIPA implementation.
Okay, Agma by default is developed on free path of taxiA
and then every gate is a deployment wide operation
because it is the project automatically
in all the servers that have the serial installed.
And this happens because it is in the LWL replicated database
and this can be managed with EPA by managed command.
It is important to remember that a lot of certificates
can accommodate over time.
So, you need a process to automatically pull
or pull or push certificates.
This is implemented with random serial numbers version 3.
This can be done automatically,
but the same can be enabled in installations
with the sequential serial numbers certificates.
That is pruning mechanisms need to be done manually,
but it is also possible.
And switch is expected to come from
installations with sequential serial numbers
to random serial numbers in the near future.
Okay, modern this,
the Apache module that are providing
as a self-certificates from your domains,
gathered from NSEA that are supporting them protocol.
It implements a robust OCSP protocol stumbling,
stumbling is the method by which it is not the browser
who contact the CA.
It is the web server instead.
And it enables a fast-page loading.
In this way, Apache are checking status of certificates
regular in the background.
And this is a process that is needed to found
in the locations.
The modern features, the main features are
certificate requests.
In terms of protocol, as we say,
automatic certificate renewal for
expediting also for revocated certificates.
Revocated is a really new feature in
the last release of modern D.
While cartetificate support,
you can also monitor certificate status,
OCSP stumbling and denotification
when cells are about to expire or being revocated.
As a fact, well, a state
the new version of modern D will enable
an annual WNR, BoquetoStatus, is observed.
But you need a graceful reload for the
HTTP server to put the certificates in place
in the running configuration.
It's great full, so it does not interrupt
the ongoing request.
And this are the main parameters that you can configure.
Then it's stumbling, it's to enable
us to be stumbling at the level of the patch server.
And it's checking terval is the interval by which
HTTP will refresh the HTTP response
be response from any certificates that are installed.
It's the minimum time for the stipulate to notice
if there are any change in the certificates.
Then the renew window is the percentage of time
before the expiration date that the certificate
is able to be renewed.
If we put 1%, it's 1%, before the expiration date.
That is, in this case, in the example of 20 minutes.
And then the stop-dent renewal window
is the minimum time to retrieve an OCSP fresh response
that is subtracted to the default time
that it's 12 hours.
If we set this to 99%, the substrate to 12,000,
this 99%, gives us approximately 7 minutes.
OK, I say previously, you need to reload the HTTP service
to be able to put the certificates in the running configuration,
but it will be nice to not have to do this periodically,
instead to this only when it is reneeded
and your absence of certificates to be enabled.
You can do that with systemD.
With systemD, you can manage
each specific file exists in your server.
And if this file exists, the system detects that this file exists,
you can trigger some actions.
In this case, you can trigger a reload of the service.
This can be combined with our archives,
also, so you can check multiple paths in your server.
And you can also multiple manage domains.
So you can have a multi-site web server
that are completely automated and scalable.
In with that, you can have all the complete lifecycle
covered.
OK, this is a demonstration about how to how
is going to run a one-expired certificate.
You can just navigate it too,
and then that means we can go here.
We will do this for sure.
We can do the same.
On the other hand.
I think they left.
Okay fine.
Thank you.
Sorry for this.
Okay.
Here you can see that the certificate is being renewed in 30 seconds.
The certificate will be expired.
You've got the certificates of your website.
The certificate is configured on the website.
You can also see the expiration date.
If it's one.
So the certificate is market to be renewed in a few minutes, a few seconds.
If you return to empty status, the renewal time has been passed.
Right now, it's being renewed.
And you have the certificates put in place.
The certificate has been raised by the.
And you have that configured in your Apache server.
And the expiration date is being updated.
Okay.
For the rocket certificate, it's more or less the same.
You can see down the latest pistachios for both.
The target.
In 40 seconds.
This will be refreshed.
You are going to robot one certificate.
You give it a reason.
You can see one of them is the rocket.
Osis pistachios still not refreshing the response.
So you can see the ticket is good.
But you can call the osis response.
And you can check that this is the rocket.
This is the expiration date.
Also.
And in 10 seconds, the certificate will be automatically.
The detected as a rocket.
You can see the osis pistachios down.
That will be changed.
This is now a rocket.
Information in the STP error lock.
And now the taxi A is running when the.
The certificate.
The patient takes a little few seconds.
Okay.
The certificate has status is good.
The new one has ratio by the taxi A.
And you can see it in the entity management.
The new certificate is.
Is generated.
And you can see the new expression date has been updated.
And now it's marketers.
So they get status is good.
Okay.
Continue this.
So we have seen the.
How free IPA is working with.
Client for traditional applications.
Because we can use this with our applications running on Kubernetes.
For that, we are going to use the thermal operator.
Okay.
This is a project for the CloudNet information.
And was initiated in 2020.
And it reaches its maturity level.
Last year on September.
Okay.
We can use different issuers.
To get certificate is front with a thermal operator.
Did you see the matrix for the use as you can see free IPA.
Okay.
But in this case, the use it.
Although where is free.
IPA is at my protocol.
Because free IPA can use the at my protocol.
So we got.
We are going to use the issue from third mana.
We can incorporate our private server.
Our private.
And.
To use the certificate.
And the root of the trust chain for the certificate.
For that, we need to use the trust.
To get it with third mana.
Okay.
Just to track the certificate for our PKI.
So a few things about the third mana.
By default, the certificates are used for 90 days.
The default is standard in the asset grid and the.
Unless the renew before field.
Has not been said.
Okay.
The minimum life for a certificate was one hour.
Okay.
Other certificates by default will be renew after.
Two of the.
The few times.
Uh, the third time.
I was.
Uh, past.
So at that moment, so a mana operator will try to renew the certificate.
Okay.
I'm going to to renew.
If some problem arises.
In that.
We can reuse the certificate on the same cost.
The certificate is going to spire.
It's one of them.
The data between the certificate and the certificate.
Specifications.
Is third mana are not much in so in the case.
And in certificate.
We'll be requested.
And if the sec.
The secret in which the certificate is kept.
Incubinetic is missing automatically.
Third mana operator will ask for an certificate.
But we cannot send a replication request from third mana.
Okay.
So we are see.
Uh, the demonstration about how to use.
Uh, to issue.
Sorry.
Certificates from.
Third mana operator.
Okay.
A start from the beginning.
Sorry.
Okay.
Now this is the operator.
This is the cluster issue.
It's the frame IPA server.
Now we're going to lock into free IPA server.
That's as the certificate is issued.
Now we're going to deploy a simple application.
I see the one.
Now we're going to check that the application is running.
In the Kubernetes.
Okay.
And now we're going to deploy an English resource.
Just to suppose the application to the outside world.
This triggers a certificate request to free IPA.
So as you see, it's there in the very field.
It's false.
This is requesting the certificate and solid challenge.
One is true.
The certificate will be issued.
I'm put into the application just to be used.
Okay.
That just means true.
We'll refresh.
And now we see a new certificate in the free IPA server.
That one.
This is all the information we have about the certificate.
And now we're going to connect to the application.
This is the external road.
This is a silly one.
And we can see the new certificate.
You see by free API.
This was all done automatically.
Okay.
As we say that the minimum time for the certificate is one hour.
We can't test it here for one hour.
Just to see how it inspires.
We're going to see how to reuse an certificate when we delete the certificate.
Okay.
This is the certificate in the terminal operator.
This is the application.
With the product certificate we have created.
Free API.
They have the certificates.
Only one.
Now we're going to get the secrets from the application to delete it.
Now we're going to delete the ticket.
That triggers an event.
The terminal operator.
Checked the secret is missing.
So he's going to request an certificate for the application.
So I'm going to delete the secret.
By mistake.
This is no problem.
Automatically we renew it.
You see that this is the enforce.
The state.
So there's no.
Now it's true.
The new certificate has been issued.
Now we're going to revoke the old one.
Because it's no longer valid.
We don't have it.
As you can see here, there are two certificates.
One goes to revoke.
This is the old one.
Ah.
The new one.
This is all information we have.
At the API.
And now we can check that this is a new certificate.
We're checking the dates.
And we have all the information again in the thermanage operator.
So we have here some resources.
There are all in the slides in the platform.
In case you want to look for more information.
Okay.
So we have seen how using free API.
At my protocol.
We can easily manage the lifecycle of our certificates.
We don't need any human.
Or hardly any human integration.
We must only to create the application.
And other certificates will be issued on renewables.
There is a fire.
We have seen two examples.
One about traditional application.
Running in Apache.
But for instance.
Or for application including in Kubernetes.
It doesn't matter.
What can application we have.
If we have an ACM client.
Because we can use our application.
Together with free IPA.
To keep our certificates updated.
Okay.
And what's more important that we can have our.
Uh.
Here.
What up?
Uh.
Hello.
Yeah.
Can we use this workflow with other global CAs instead of Let's Angry?
So what the question was, can we use this workflow with other global CAs instead of Let's Angry?
This is not Let's Angry. This is your deployment of free IDEA CAs.
This is like your stuff. You can get it in just use the same standard at now.
That Let's Angry implemented for the public.