View
12
Download
0
Category
Preview:
Citation preview
digital.Media.Solutions
© AMAN Media GmbH – Jens Rosenthal
digital.Media.Solutions
Munich, May 2018
PKI AUTOMATION IN THE CLOUD
digital.Media.Solutions
© AMAN Media GmbH – Jens Rosenthal
digital.Media.Solutions
PKI - THE INFRASTRUCTURE
Online - AWS Cloud
Server EU
Server EU
OCSP Integ.
Server EU
Server EU
OCSP US
Server EU
Server EU
OCSP EU
Offline - inaccesible Offline
Root CA
TLS CA
Backend CA
Client CA
TLS EU CA
TLS US CA
TLS Integ. CA
Client EU CA
Client US CA
Client Integ. CA
Server EU
Server EU
Server EU
Server US
Server US
Server US
Server AP
Server AP
Server Integ.
digital.Media.Solutions
© AMAN Media GmbH – Jens Rosenthal
digital.Media.Solutions
CHALLENGES & RISKS
Challenges:
● Multiple environments
○ Multiple CAs
○ DN naming structure
○ Overview
● Multiple suppliers
● Scaling of instances
● CRL maintenance
Risks:
● Human factor
○ CSRs with wrong DNs
○ CSRs with identical keys
○ CRTs from wrong CA
○ CRTs from wrong CSR
● Response time
○ manual effort during scaling
digital.Media.Solutions
© AMAN Media GmbH – Jens Rosenthal
digital.Media.Solutions
SOLUTION: AUTOMATION
Semi-automated workflow:Provisioning of a new container
(CA, OCSP, Server)
Automated PKI setup(generate Key and CSR)
Automated CSR submission(PKI Proxy)
Manual CSR submission(PKI Proxy)
Offline signing(with validation)
Manual CRT submission
Automated CRT download(PKI Proxy)
Manual CRT download(PKI Proxy)
digital.Media.Solutions
© AMAN Media GmbH – Jens Rosenthal
digital.Media.Solutions
STEP-BY-STEP: UPLOAD CSR
digital.Media.Solutions
© AMAN Media GmbH – Jens Rosenthal
digital.Media.Solutions
STEP-BY-STEP: UPLOADED CSR
digital.Media.Solutions
© AMAN Media GmbH – Jens Rosenthal
digital.Media.Solutions
STEP-BY-STEP: ADD DETAIL INFORMATION
digital.Media.Solutions
© AMAN Media GmbH – Jens Rosenthal
digital.Media.Solutions
STEP-BY-STEP: ADD VALIDATION INFORMATION
digital.Media.Solutions
© AMAN Media GmbH – Jens Rosenthal
digital.Media.Solutions
STEP-BY-STEP: VALIDATE AND SIGN CSR
digital.Media.Solutions
© AMAN Media GmbH – Jens Rosenthal
digital.Media.Solutions
STEP-BY-STEP: DOWNLOAD SIGNED CRT
digital.Media.Solutions
© AMAN Media GmbH – Jens Rosenthal
digital.Media.Solutions
SOLUTION: AUTOMATION
Benefits:
● Validation○ of DNs in CSRs○ of signed CRTs
● Assistance○ automated assignment of signing CAs○ automated assignment of certificate purpose○ documentation○ overview
● Self-Service○ semi automated process○ authentication / authorization○ faster
digital.Media.Solutions
© AMAN Media GmbH – Jens Rosenthal
digital.Media.Solutions
QUESTIONS?
Time for questions
JENS ROSENTHALSoftware Architect
AMAN digital media solutionswww.aman.de / jens.rosenthal@aman.de
Recommended