You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Now that we're actually doing authentication when talking to the Cuckoo API (#91) the next logical step is to make sure we're talking to the right server and encrypt the connection so the authentication token isn't compromised. Both would be handled by switching the API connection to HTTPS.
This might be possible without any code change by adjusting the url parameter in peekaboo.conf:cuckoo. It would require the CA cert of the Cuckoo API's certificate to be in the system-wide cert store, though. Since it's an internal backend connection, users will likely want to use self-signed or non-offical-CA-signed certificates for it. So we should at the very least allow an alternate CA cert path.
Additionally, when using an official CA we should account for certificate revocation and therefore allow configuration and checking of a CRL or OCSP responder (Phew but the right way to do it[tm] IMO).
The text was updated successfully, but these errors were encountered:
Now that we're actually doing authentication when talking to the Cuckoo API (#91) the next logical step is to make sure we're talking to the right server and encrypt the connection so the authentication token isn't compromised. Both would be handled by switching the API connection to HTTPS.
This might be possible without any code change by adjusting the
url
parameter inpeekaboo.conf
:cuckoo
. It would require the CA cert of the Cuckoo API's certificate to be in the system-wide cert store, though. Since it's an internal backend connection, users will likely want to use self-signed or non-offical-CA-signed certificates for it. So we should at the very least allow an alternate CA cert path.Additionally, when using an official CA we should account for certificate revocation and therefore allow configuration and checking of a CRL or OCSP responder (Phew but the right way to do it[tm] IMO).
The text was updated successfully, but these errors were encountered: