oxidecomputer / offline-keystore

yubihsm-setup replacing the yubico cruft with our own cruft!
Mozilla Public License 2.0
10 stars 1 forks source link

debug credential audit trail #196

Open flihp opened 8 months ago

flihp commented 8 months ago

142 raises questions about the constraints we want / need to enforce when signing debug credentials. The comparison is made w/ our CA operations in that they prevent us from issuing certs w/ identical serial numbers or the same subject fields. Similar (or dissimilar) constraints may be required of debug credentials. Some questions we should consider: Do we want our tools to prevent us from issuing a DC that's identical to a previously issued one? Other considerations?