pki

What would you like to be added

I'd like to have the option to not have the HSM pin stored in a configuration file, but instead be required to be entered manually by an operator each time the CA is started.

Why this is needed

Having HSM pins sitting on the file system weakens the security in cases of hardware being stolen.

In theory if the PIN is not known then stealing a server a

This issue was migrated from Pagure Issue #3199. Originally filed by rcritten (@rcritten) on 2020-08-03 15:59:52:

• Assigned to nobody

IPA can be installed in a CA-less configuration with the user providing the certificates required for operation. Running ipa-healthcheck with this will generate quite a few pk

During our last meeting, we discussed how should the server/the client compute the commitment:

• Main concern: server is using a static salt which would allow an attacker to test whether keys exist in the tree
  => client sends salt along with the registration
  => need secure PRNG

• How to ensure the server is using the right commitment scheme? Client should verify with the scheme specified

Details of the scenario you tried and the problem that is occurring:
In the resource CertificateImport there should be no need to have the non-mandatory parameter Ensure in the Get-TargetResource function.

https://github.com/PowerShell/CertificateDsc/blob/6906fc5b31a783a899260c9c9d4ba84a02dd4c14/Modules/CertificateDsc/DSCResources/MSFT_CertificateImport/MSFT_CertificateImport.psm1#L65-