Contents
Does TLS require PKI?
TLS: According to the book “Cellular Authentication for Mobile and Internet Services” and RFC2246, One of the biggest existing use case for PKI stems from the use of certificates in the Transport Layer Security (TLS) and TLS supports client certificate.
Why is PKI so complicated?
The tricky part of PKI is the infrastructure, a system for generating and managing keys and digital certificates that contain them. Burr said one of these wrong horses was the decision to use a bridge certificate authority rather than a single central certificate authority to issue and manage digital certificates.
Why do we need PKI?
PKI is a critical part of the IT strategic backbone. PKI is important because the certificate-based technology helps organizations establish trusted signature, encryption, and identity between people, systems, and things.
How to configure TLS / SSL and PKI authentication?
Configuring security along with TLS/SSL and PKI can seem daunting at first, and so this blog gives step-by-step instructions on how to: enable security; configure TLS/SSL; set passwords for built-in users; use PKI for authentication; and finally, how to authenticate Kibana to an Elasticsearch cluster using PKI.
How does SSL / TLS public key infrastructure work?
To make the story short, if you know the public key of some entity (a server, a human user…) then you can establish a secured data tunnel with that entity (e.g. with SSL/TLS in a connected context, or encrypting emails with S/MIME). The problem, now, is one of key distribution.
What to do if TLS certificate does not have extended key usage?
If TLS/SSL certificates do not have Extended Key Usage defined, then they are already defacto client and server certificates. If transport certificates do have an Extended Key Usage section, which is often the case for CA-signed certificates used in corporate environments, then they must explicitly enable both clientAuth and serverAuth .
When do I need to enable transport TLS / SSL?
For a cluster that is running in production mode with a production license, once security is enabled, transport TLS/SSL must also be enabled. However, if we are running with a trial license, then transport TLS/SSL is not obligatory.