ca

B4CKSP4CE Certification Authority

This is the B4CKSP4CE internal Certificate Authority. It is used to sign certificates for internal services and infrastructure.

Installation

# Create a directory within ca-certificates, then download the root certificate
sudo mkdir -p /usr/share/ca-certificates/bksp
curl -fSsl https://ca.bksp.in/root/bksp-root.crt | sudo tee /usr/share/ca-certificates/bksp/B4CKSP4CE_Root_CA.crt

# Create a symbolic link in system trust store, then add the entry for ca-certificates configuration
echo "bksp/B4CKSP4CE_Root_CA.crt" | sudo tee -a /etc/ca-certificates.conf

# Update the system trust store
sudo update-ca-certificates

Rules of Engagement

  1. Don’t trust this CA. Just don’t.
  2. Wherever you need it, enable this CA only for your particular application. Never install it to system trust stores.
  3. This CA uses a secp384r1 ECDSA with SHA256 defaults. RSA-3072 is also supported for selected intermediates.
  4. Every intermediate CA have strict restricted-first Name Constraints.

Overview

Security Contact

Please find a ssh-ed25519 public key and email address in the snippet below. Expect all replies to be signed with this key. You may encrypt your message using this key with age.

# Extract the public key from the Root CA certificate
curl -fSsl https://ca.bksp.in/root/bksp-root.crt | openssl x509 -noout -pubkey > root-ca.pub

# Download the contact proof signature
curl -fSsl https://ca.bksp.in/sig/noc-contact-proof.asc > noc-contact-proof.asc

# Verify the signature
echo -ne "Security: noc@bksp.in (ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJRwsb2wqvmakJnI9g8LQW5tTQJrgixFci/MTxSIEpq4)" | \
openssl dgst -sha256 -verify root-ca.pub -signature noc-contact-proof.asc -binary -

B4CKSP4CE Root CA

B4CKSP4CE A1

Internal Devices CA.

B4CKSP4CE A2

Internal Services CA.

This site is open source. Improve this page.