密钥/证书管理的最佳实践
我正在部署数百/数千台小型服务器，它们通过 HTTPS 和 ssh 与我的托管母舰进行通信。
当可能需要撤销 SSL 客户端证书（针对 https）和 ssh 密钥时，管理它们的最佳实践是什么？我正在考虑诸如在更改时分发密钥/证书、管理撤销、何时需要单独的 ssh 密钥与共享密钥等问题......
I'm deploying hundreds/thousands of small servers that communicate with my hosted mothership via HTTPS and ssh.
What are the best practices for managing SSL client certs (for https) and ssh keys, when either might need to be revoked? I'm thinking about issues like distributing keys/certs on change, managing revocation, when an individual ssh key is needed vs a shared one...
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
在客户端生成密钥，将密钥对保存在 SQLite 数据库中（最好是加密的），通过 Web 方法将公钥传输到服务器，并将其保存在那里。
由于它是公钥，因此您可以不加密地传输和保存它。
（可以选择在服务器上生成密钥并将公钥发送回客户端）
当需要撤销密钥时，只需删除服务器上的相应密钥即可。
Generate the key on the client, save the keypair in a SQLite database (preferably encrypted), transmit the public key to the server via web-methods, and save it there.
Since it's a public key, you can transmit and save it unencrypted.
(Optionally generate a key on the server and send the public key back to the client)
When a key needs to be revoked, you simply delete the respective keys on the server.
对于数千台服务器，您可以考虑使用 Venafi Encryption Director 等企业产品：http:// www.venafi.com/Products/Venafi-Encryption-Director/ 虽然报价昂贵，所以您必须确定它是否值得。
还有一些具有类似功能的免费产品（http://www.kousec.com/download.html），但它们的功能并不那么强大。
For thousands of servers you might consider using an Enterprise product like Venafi Encryption Director: http://www.venafi.com/Products/Venafi-Encryption-Director/ It is quote expensive though so you'll have to determine if it is worth it.
There are also free products (http://www.kousec.com/download.html) that have similar functions but they aren't nearly as robust.