4

OCSP responses may be signed not only by the CA itself, but also a designated OCSP signer. That's an X.509 certificate issued by that CA with the OCSPSigning (1.3.6.1.5.5.7.3.9) extended key usage. For details see RFC 6960, section 4.2.2.2.


2

I'm coming from the assumption that you don't leave any backdoor open in either of the methods, and choose high-entropy passwords for Basic Auth. In that case, the biggest difference between the methods is that HTTPS will encrypt the traffic and prevent Man-in-the-Middle Attacks, making it impossible for anyone to eavesdrop, whereas Basic Auth will not. So ...


2

Per https://stackoverflow.com/questions/50622163/rpm-signing-using-x-509-certificatesenter link description here there is no way to sign RPMs with x509 style signatures that will be checked by the standard tools for installing RPMS. If signing x509 style is the important part then your best bet is to distribute the two files alongside the rpm along with ...


1

This will mean that if the root CA is compromised that exposure should be minimal if no users trust it directly. The above doesn't make sense. Another name for the Root CA certificate is the trust-anchor. As the anchor of trust, you must install it in order for any subordinate CAs and subsequently end-entity certificates to be trusted. If you expect the ...


1

The PKI is based on CA certificates, which are certificates you trust to vouch for other certificates. You will always have a copy the certificate for the CA. Let's call it "bdxCA" When Bob comes with a certificate saying "Hi, I'm Bob, here's my certificate signed by bdxCA", the computer looks up his copy of bdxCA, see it did sign the certificate and that ...


1

Easy way? Get whoever provided you the key file to give you a valid one, because they one they gave you is damaged or was generated incorrectly. Without seeing the key itself, nobody will be able to give you more information than that, short of a lot of guesses of ways that the key could be invalid or a lot of instruction on the format of OpenPGP keys ...


1

Simplification Neither option is remotely secure. But you present those as THE options, so I'll address them first, then present you an option 3. Security: Technical Given your two options, neither is technically superior. The addition of SSL/TLS would only be security theater. In regards to your public internet exposure, neither option provides ...


Only top voted, non community-wiki answers of a minimum length are eligible