Secure your Cloud Services with TLS X.509 Client Certificates

How to secure Internet Servers with X.509 Client Certificates? How to deploy X.509 Client Certificates ? How does a Certificate Signing Request (CSR) work ? In this hands-on video we will run a little nodejs Server that requests Authentication with an X.509 Client Certificate, we will Sandbox a CSR with XCA and we will have a look at OpenXPKI which is a great Software to automate processes around TLS and Certificate Generation, Key Management and the like. Last but not least I show a Blueprint on how to securely link a hosted MQTT into your home automation Software.

0:00 The use case
1:27 Get the Demo Server from my Github repo
4:20 How to generate client certificates
5:37 How secure is this?
8:04 How to deploy client certificates
9:16 Certificate Signing requests (CSR)
12:45 OpenXPKI
14:10 A blue print for a secure MQTT / Home Automation App

[pberto]

This third episode very confirm I havn't studied enough in my job, Marc.

[nvxmpqc]

I really do not know how i watched the best of best tutorials for free here.

[jankoweise]

Not only excellent content, but also structured and examplified to perfection. And on top of that, it was fun to listen to it. Great tutorial.
Abonniert

[SparklingVega]

beautifully explained, Thank you Marc

[dpg]

That was awesome Marc!! Very well explained

[mihai]

I like the "Certificate Signing requests (CSR)" part

[edwardvanhazendonk]

Thanks for sharing this 3 videos, very informative and useful tools and tips! Great to have a smaller attack vector on our hosted stuff!

[BrunoAlves-jntj]

Hi Marc,
I am using this playlist as study material for LPIC-3 exam, is really difficult find a good material about this subject and well-explained as you did in this playlist. Thank you so much!

[raunomakela]

More of these for sure!
Revocation of the same?
Use this with;
NextCloud?
Pfsense management portal?

[tissandre]

To come back on my comment on the 1st video, I've done some research and, apparently, SSH don't support X.509 certificate natively. But, you still can generate CA keys with OpenSSL and use the same technique to secure a SSH connection.
I'm trying to generate a X.509 key on my Yubikey and use this key a autehntication for a SSH server. But I must use SSH CA and Keys instead. (Which still can be stores on a Yubikey anyway, but are harder to access)
But, as always your videos are really great stuff!
Thanks!

[ganonbit]

very thorough and helpful for my current project, thank you!

[raughboy]

Also it's worth noting that TLS certificate is successor to ssl thus more secure.

[remyzandwijk]

Thanks for another great video Marc. I am wondering, how do you handle (client) certificate revocation? If certificates cannot be revoked, the application might be as well considered insecure imho. (I know, explaining it add minutes to the video, but I think it is worth explaining how it is done.)

[electrotsmishar]

Thanks a lot. Your videos are very helpful and informative. Keep up your good work

[RifatErdemSahin]

green screen quality getting better with the light

[BS-myky]

Superb! Let's if you lost your phone. How do you revoke that trust from the phone to your VPS from opening your garage door?

[BoyanYanakiev]

Great video again Marc!
Is it just me that has the home network features track your video topics? :)

I have a question on this one. In the video you mention that there is no need to punch through the firewall and i have seen/heard this in other videos/tutorials on home security offering different solutions. Can you please explain (in the simplest way that only you can :) ) how is a certificate better than using wireguard for example? You mention at about min 15 no VPN, no firewall holes. I get how port forwarding is different and how passwords are insecure but even in this video you talk about connection on port 8443. So how is that more or less secure than wireguard into openwrt on port 51820. Both use public key cryptography and both use fixed port connections. The only difference i see is that may be in the example with the MQTT you give the home router does not need fixed IP... but there are ways around that as well for a vpn. In a wireguard set up i only need exchange the public keys as well similar to the sign request. What is it that i don't see?

[dexterman]

This series was amazing! I am following your videos and managed to set up a VLAN and I am kinda excited haha. Thank you :)
A quick question though. I want to be able to access my home but was thinking if there was a way I can reject connections at the packet level, for minimizing issues with applications security issues. Is that possible? If so, how do I do that?

[TahaZabuawala]

Awesome tutorial? Can someone share the links of the first 2 videos of this series

[naiko]

Great video, thank you! Is this secure enough? Would a DMZ (e.g. for IoT devices) still be necessary to avoid potential access to my LAN (other private devices such as my PC)?