site banner
PaperclipPerfector  1mo ago (text post)   2830 thread views

Small-Scale Question Sunday for October 20, 2024

Do you have a dumb question that you're kind of embarrassed to ask in the main thread? Is there something you're just not sure about?

This is your opportunity to ask questions. No question too simple or too silly.

Culture war topics are accepted, and proposals for a better intro post are appreciated.

3
Top Bottom Old Controversial Comments
Jump in the discussion.

No email address required.

Hope everyone is doing well.

Currently, I am working as a software engineer with limited experience. My boss recently came up with an idea for a new product that requires mTLS to connect with a server. However, I’ve never worked with something like this before.

Does anyone have any good resources where I can learn more about this topic?

Any help would be greatly appreciated!

Hey I have previously worked on the same thing, I would highly recommend this book as a reference-

https://www.feistyduck.com/books/bulletproof-tls-and-pki/

Whatever HTTP library you use should support it. Just check the documentation for the library. The admins of the server might require you to send them a CSR so they can sign you a certificate. You can use openssl command line tools to generate a CSR. If you do need to generate a CSR the admins of the server should explain the requirements of the CSR and ideally they should give you the openssl command you can use to generate the CSR. Though, I guess depending on what this is for there might be security requirements about how key material is generated/stored.

I think the main potentially pitfall around mTLS is how libraries handle pooling if you use multiple certificates. Often libraries don't use the certificate as part of the pool key so if you try and make a request with certificate X you might end up making a request with certificate Y [!?]. But if you are only using a single certificate then this cannot happen.

mTLS also gives you the option of protecting the private key using a HSM so the key material is never exposed outside of the HSM. But I'm guessing this is probably overkill for whatever you are doing.

EDIT:

This is assuming you are using HTTP but I guess if you are just sending bytes over the wire or have another protocol then your TLS library documentation should explain how to use mTLS.

What is this place?

This website is a place for people who want to move past shady thinking and test their ideas in a court of people who don't all share the same biases. Our goal is to optimize for light, not heat; this is a group effort, and all commentators are asked to do their part.

The weekly Culture War threads host the most controversial topics and are the most visible aspect of The Motte. However, many other topics are appropriate here. We encourage people to post anything related to science, politics, or philosophy; if in doubt, post!

Check out The Vault for an archive of old quality posts. You are encouraged to crosspost these elsewhere.


Why are you called The Motte?

A motte is a stone keep on a raised earthwork common in early medieval fortifications. More pertinently, it's an element in a rhetorical move called a "Motte-and-Bailey", originally identified by philosopher Nicholas Shackel. It describes the tendency in discourse for people to move from a controversial but high value claim to a defensible but less exciting one upon any resistance to the former. He likens this to the medieval fortification, where a desirable land (the bailey) is abandoned when in danger for the more easily defended motte. In Shackel's words, "The Motte represents the defensible but undesired propositions to which one retreats when hard pressed."

On The Motte, always attempt to remain inside your defensible territory, even if you are not being pressed.


New post guidelines

If you're posting something that isn't related to the culture war, we encourage you to post a thread for it. A submission statement is highly appreciated, but isn't necessary for text posts or links to largely-text posts such as blogs or news articles; if we're unsure of the value of your post, we might remove it until you add a submission statement. A submission statement is required for non-text sources (videos, podcasts, images).

Culture war posts go in the culture war thread; all links must either include a submission statement or significant commentary. Bare links without those will be removed.

If in doubt, please post it!


Rules


Recommended Posts And Communities

Recommended Realtime Chats