Upload File

minimizing the window of compromise …...1 2 3 ca node swarmkit’s implementation renew valid from...

  • Home
  • Documents
  • MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate
61
PRACTICAL MTLS MINIMIZING THE WINDOW OF COMPROMISE Ying Li @cyli

Upload: others

Post on 21-Jun-2020

0 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

PRACTICAL MTLSMINIMIZING THE WINDOW OF COMPROMISE

Ying Li @cyli

Page 2: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

TYPICAL MICROSERVICE ARCHITECTURE

PROBLEM

S1

S1S2

S3

DB

VPC

Page 3: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

VLAN-TASTIC MICROSERVICE ARCHITECTURE

PROBLEM

S1

S1S2

S3

DB

Page 4: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

CORRECT MICROSERVICE ARCHITECTURE

PROBLEM

S1

S1S2

S3

DB

Page 5: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

APPLICATION TLS LIFECYCLE

Bootstrap RevokeRenew

PROBLEM

Page 6: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

• CSR ➡ CA • Configuration

BOOTSTRAP

PROBLEM

Page 7: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

• Schedule

RENEW

PROBLEM

Page 8: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

• Schedule • CSR ➡ CA • Configuration

RENEW

PROBLEM

Page 9: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

• Schedule • CSR ➡ CA • Configuration • Restart

PROBLEM

RENEW

Page 10: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

• CRL • OCSP [Stapling]

REVOKE

PROBLEM

Page 11: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

AUTOMATE, AUTOMATE, AUTOMATE

• Promotes adoption of mTLS

PRINCIPLE

Page 12: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

AUTOMATE, AUTOMATE, AUTOMATE

• Promotes adoption of mTLS • Single location for private key

PRINCIPLE

Page 13: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

AUTOMATE, AUTOMATE, AUTOMATE

• Promotes adoption of mTLS • Single location for private key • Shorter certificate expiry

PRINCIPLE

Page 14: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

SWARMKIT OVERVIEW

https://github.com/docker/swarmkit

Page 15: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

SWARMKIT OVERVIEW

Worker

Manager

Manager ManagerWorker

Worker

Worker

WorkerWorker

CLUSTER

Page 16: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

SWARMKIT OVERVIEW

Worker

Manager

Manager ManagerWorker

Worker

Worker

WorkerWorker

CLUSTER

NodeNode

Node

NodeNode

Node

Page 17: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

SWARMKIT OVERVIEW

Worker

Manager

Manager ManagerWorker

Worker

Worker

WorkerWorker

raft store

CLUSTER

Page 18: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

SWARMKIT OVERVIEW

Node

CA

CA CANode

Node

Node

NodeNode

raft store

CLUSTER

Page 19: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

SWARMKIT’S IMPLEMENTATION

Page 20: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

BOOTSTRAP

SWMTKN-1-mx8suomaom825bet6-cm6zts22rl4hly2Known Prefix

Token Version

Hash of Root CA

Random Secret

SWARMKIT’S IMPLEMENTATION

Page 21: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

1. Retrieve, validate Root CA certificate.

BOOTSTRAP

1

CA

Node

SWARMKIT’S IMPLEMENTATION

Page 22: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

1. Retrieve, validate Root CA certificate.

2. CSR + secret token ➡ CA. (TLS)

BOOTSTRAP

1 2

CA

Node

SWARMKIT’S IMPLEMENTATION

Page 23: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

1. Retrieve and validate Root CA Public key material.

2. CSR + secret token ➡ CA. (TLS)

3. Get certificate. (TLS)

BOOTSTRAP

1 23

CA

Node

SWARMKIT’S IMPLEMENTATION

Page 24: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

RENEW

Valid From

Valid Until

50% 80%

SWARMKIT’S IMPLEMENTATION

Page 25: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

1. CSR + ➡ CA. (mTLS)

2.Get certificate. (mTLS)

RENEW

1 2

CA

Node

SWARMKIT’S IMPLEMENTATION

Page 26: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

RENEW

Restart

1. Trigger extra leader election

2. Workers all need to reconnect to managers

3. Reschedule work

SWARMKIT’S IMPLEMENTATION

Page 27: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

RENEW

SWARMKIT’S IMPLEMENTATION

Page 28: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

RENEW

SWARMKIT’S IMPLEMENTATION

Page 29: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

RENEW

Server

Existing connections

New connections

SWARMKIT’S IMPLEMENTATION

Page 30: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

RENEW

Client

Existing connections

New connections

SWARMKIT’S IMPLEMENTATION

Page 31: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

REVOKE

SWARMKIT’S IMPLEMENTATION

Page 32: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

REVOKE

SWARMKIT’S IMPLEMENTATION

REMOVE

CRLS, OCSP [Stapling]

Page 33: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

REMOVE

SWARMKIT’S IMPLEMENTATION

NODE BLACKLISTNode ID Certificate Expiry

a8h1vsk3k9o5nwea858ty9kma 2017-08-26 01:02:52 UTC

k80l2au3yq9f7x6r2oca13vwt 2017-07-15 11:35:23 UTC

n970d5be9ccgnreg4iti4jho3 2017-08-01 22:59:05 UTC

Page 34: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

REMOVE

SWARMKIT’S IMPLEMENTATION

Worker/Manager Manager

Request

Validate node IDagainst blacklist

Authorize role

Perform work

Response

Worker/Manager Manager

Page 35: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

REMOVE

SWARMKIT’S IMPLEMENTATION

BLACKLIST VS WHITELIST

Page 36: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

REMOVE

SWARMKIT’S IMPLEMENTATION

Manager

Manager Manager

delayed join

Page 37: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

REMOVE

SWARMKIT’S IMPLEMENTATION

Manager

Manager Manager

Page 38: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

Rotate CA

PROBLEM

Page 39: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

CA ROTATION

PROBLEM

• (conf.) All nodes: trust old and new CA • (wait.) Verify all nodes

1

Page 40: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

CA ROTATION

PROBLEM

• (conf.) All nodes: trust old and new CA • (wait.) Verify all nodes • (conf.) All nodes: renew certificates • (wait.) Verify all nodes

1

2

Page 41: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

CA ROTATION

PROBLEM

• (conf.) All nodes: trust old and new CA • (wait.) Verify all nodes • (conf.) All nodes: renew certificates • (wait.) Verify all nodes • (conf.) All nodes: trust new CA only • (wait.) Verify all nodes

1

2

3

Page 42: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

CROSS-SIGNED INTERMEDIATE

RootA

Key Info: A Signed by: A

RootB

Key Info: B Signed by: B

RootB

X

Leaf cert: X Signed by: B

Root: B

PRINCIPLE

Page 43: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

CROSS-SIGNED INTERMEDIATE

RootA

Key Info: A Signed by: A

RootB

Key Info: B Signed by: B

RootA

X

Leaf cert: X Signed by: B

Root: A

PRINCIPLE

Page 44: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

CROSS-SIGNED INTERMEDIATE

RootA

Key Info: A DN: A Signed by: A

RootB

Key Info: B DN: B Signed by: B

Key Info: B DN: B Signed by: A

RootA

RootA

IntermediateB’

PRINCIPLE

Page 45: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

Leaf cert: X Signed by: B’

Root: A

RootA

RootA

IntermediateB’

X

CROSS-SIGNED INTERMEDIATE

PRINCIPLE

Page 46: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

RootA

RootA

IntermediateB’

RootB

Leaf cert: X Signed by: B

Root: B

X

CROSS-SIGNED INTERMEDIATE

PRINCIPLE

Page 47: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

CA ROTATION

SWARMKIT’S IMPLEMENTATION

• (conf.) All nodes: trust old and new CA • (wait.) Verify all nodes • Generate cross-signed intermediate

Page 48: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

CA ROTATION

SWARMKIT’S IMPLEMENTATION

• Generate cross-signed intermediate • (conf.) All nodes: renew certificates • (wait.) Verify all nodes

1

Page 49: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

CA ROTATION

SWARMKIT’S IMPLEMENTATION

• Generate cross-signed intermediate • (conf.) All nodes: renew certificates • (wait.) Verify all nodes • (conf.) All nodes: trust new CA • (wait.) Verify all nodes • Throw away cross-signed intermediate

1

2

Page 50: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

CA ROTATION: BEFORE ROTATION

SWARMKIT’S IMPLEMENTATION

Node Trust Root:

Node TLS Certificate:

Cluster Trust Root:

Cluster Cert Issuer:

RootA

RootA

RootA

RootA

RootAZ

Page 51: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

CA ROTATION: START ROTATION

SWARMKIT’S IMPLEMENTATION

Node Trust Root:

Node TLS Certificate:

RootA

RootA

RootA

IntermediateB’

Cluster Trust Root:

Cluster Cert Issuer:

RootA

RootA

RootAZ

Page 52: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

CA ROTATION: NODE CERT RENEWAL

SWARMKIT’S IMPLEMENTATION

Node Trust Root:

Node TLS Certificate:

RootA

RootA

RootA

IntermediateB’

Cluster Trust Root:

Cluster Cert Issuer:

RootA

RootA

RootA

IntermediateB

X

Page 53: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

CA ROTATION: NODE CERT RENEWAL

SWARMKIT’S IMPLEMENTATION

Node1 Node2 Node3 Node4 Node5

Trust Root

TLS Certificate

RootA

RootA

Z

RootA

Ro AIntermediate

B

X

RootA

Ro AIntermediate

B

X

RootA

Ro AIntermediate

B

X

RootA

Z

RootA

RootA

RootA

RootA

Page 54: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

CA ROTATION: ROTATE TRUST ROOT

SWARMKIT’S IMPLEMENTATION

Node Trust Root:

Node TLS Certificate:

RootB

Cluster Trust Root:

Cluster Cert Issuer:

RootB

RootA

RootA

IntermediateB

RootB

X

RootA

RootA

IntermediateB’

Page 55: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

CA ROTATION: ROTATE TRUST ROOT

SWARMKIT’S IMPLEMENTATION

Node1 Node2 Node3 Node4 Node5

Trust Root

TLS Certificate

RootB

RootB

RootB

RootA

Ro AIntermediate

B

X

RootA

Ro AIntermediate

B

X

RootA

Ro AIntermediate

B

X

RootA

Ro AIntermediate

B

X

RootA

Ro AIntermediate

B

X

RootA

RootA

Page 56: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

CA ROTATION: FINISH ROOT ROTATION

SWARMKIT’S IMPLEMENTATION

Node Trust Root:

Node TLS Certificate:

RootB

Cluster Trust Root:

Cluster Cert Issuer:

RootB

RootB

RootA

RootA

IntermediateB

RootB

X

Page 57: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

DEMO

Page 58: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

SUMMARY

MINIMIZING THE WINDOW OF COMPROMISE

Page 59: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

SUMMARY

MINIMIZING THE WINDOW OF COMPROMISE• automatic bootstrap, renewal • short certificate expiry

Page 60: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

SUMMARY

MINIMIZING THE WINDOW OF COMPROMISE• automatic bootstrap, renewal • short certificate expiry • certificate revocation • CA rotation

Page 61: MINIMIZING THE WINDOW OF COMPROMISE …...1 2 3 CA Node SWARMKIT’S IMPLEMENTATION RENEW Valid From Valid Until 50% 80% SWARMKIT’S IMPLEMENTATION 1. CSR + CA. (mTLS) 2.Get certificate

SUMMARY

MORE INFORMATION

https://github.com/docker/swarmkit

https://diogomonica.com/2017/01/11/hitless-tls-certificate-rotation-in-go/

https://github.com/cloudflare/cfssl

(@cyli)


Engg Mtls Chapter1

1995 Warren Determining the Fracture Toughness of Brittle Mtls by Hertz Indent

VALID 3 APRIL - 14 APRIL 2019 Member Savings Coupons · valid 3 april - 14 april 2019 valid 3 april - 14 april 2019 valid 3 april - 14 april 2019 valid 3 april - 14 april 2019 valid

MTLS - Major Incident 2013

Airway and Ventilatory Management MTLS

RADIAL AIR BEARING PRODUCT … MTLS...radial air bearing product specifications specifications and tolerancing information for concave and convex configurations

Empowering Teacher Leaders - BrainSMART · Teacher Leader Standards, or MTLS ... † Modeling and articulating exemplary instructional strategies ... were becoming more

Schafrik History of Mtls in Jet Engines 1

Lab Manual- Engg Mtls

Namecheap.com - Support - Knowledgebase - Valid Formats and Data Values for .CA domains · 2011. 1. 14. · Namecheap.com 11400 W. Olympic Blvd. Suite 200, Los Angeles, CA 90064,

MTLS Oppday 58Q2

Corrosion and Chemical Resistant Masonry Mtls Hbk (PARTIAL) - W. Sheppard (Noyes, 1986) WW

MTLS in a Microservices World

COUPONS - Microsoft · 2018-12-05 · valid 7 - 23 december 2018 valid 7 - 23 december 2018 valid 7 - 23 december 2018 valid 7 - 23 december 2018 valid 7 - 23 december 2018 valid

Discovering Possibilities of Implementing Multipurpose ... · PDF fileDiscovering Possibilities of Implementing Multipurpose Cadastre ... The output of MTLS after processing is 3D

Uncertainty Quantification of Crosstalk Using Stochastic ... · transmission lines, multiconductor transmission lines (MTLs), and nonuniform MTLs (NMTLs) in the time and frequency

Digital Tachograph System Romanian CA Policy · Digital Tachograph System Romanian CA Policy v. 1.7 2 Scope and applicability [r1] The NCA policy is valid for the Tachograph system

AP Gr 7 Learners Mtls q12

Nets DanID CPS - Certification Practice Statement Public · PDF fileCPS – Certification Practice Statement Classification Approved by Valid from Version Page Public CA Management

PASSPORT TO SAVINGSOffer valid only at Sears Optical at The Mall at Robinson. May be combined with in-store offers. Not valid in OK and PR. Void in La Jolla and El Cajon, CA and where

Valid through 12/31/19 Valid through 12/31/19 Valid

Mtls p kinematic

Goldman Sachs Basic Mtls JUN09

Muangthai Leasing PCL (MTLS)mtls.listedcompany.com/misc/analyst-research/20161102-mtls-aws-en.pdfManagement expects the level of provision expense in the last two quarters of the year

Engg Mtls Chapter2

VALID SSL DOMAIN VALIDATION CERTIFICATE AUTHORITY ...global.validcertificadora.com.br/ca-validssl-dv/cps-validssl-dv.pdf · valid ssl domain validation certificate authority certification

Step 1: Select - TN.gov...Issuer: Veterans Affairs User CA Bl Valid From: 08/13/2018 to 08/12/2021 Authentication - Stephen Bell 1685171 (affiliate) Issuer: Veterans Affairs User CA

Six Easy Leactures on Ancient Mathematical Astronomy - D. Duke [Univ of FL Lecture Mtls] WW

Data Based on MTLS Algorithm

Muangthai Leasing PCL (MTLS)mtls.listedcompany.com/misc/analyst-research/20160427...Results Preview 27 Apr 2016 1 Please see disclaimer on last page Muangthai Leasing PCL (MTLS) Expect

Review of Engg Mtls

Study Materials for MIT Course [8.02T] - Electricity and Magnetism [FANTASTIC MTLS]

Microscale Processing of Silk Protein - MEPTEC.ORG - REFACTORED MTLS - BRESLAUER.pdf · Microscale Processing of Silk Protein David N. Breslauer, Ph.D. Chief Scientific Officer,

valid California driver’s license. A California POST ... · CITY OF Livermore, CA INVITES YOUR INTEREST IN THE POSITION OF Police Chief valid California driver’s license. A California

Ceramic Science MTLS 4RO3 - Course Notescoursenotes.mcmaster.ca/4R03/LECTURE_1.pdf · Ceramic Science MTLS 4RO3 th es. ... Seminar and Report Topic selection: ... electrical insulators,