Miscellaneous Security

Examine your JVM's certificates of your Certificate Authorities with the tool provided by the JDK:

keytool --list -keystore /usr/lib/jvm/jdk-25.0.2+10/lib/security/cacerts

This can tell you if your credentials are broken:

$ openssl s_client -showcerts -connect YOUR_DOMAIN:443

CONNECTED(00000003)

depth=2 C = US, O = Amazon, CN = Amazon Root CA 1

...

Certificate chain

 0 s:CN = emryspolaris.click

   i:C = US, O = Amazon, CN = Amazon RSA 2048 M01

   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256

   v:NotBefore: Nov 21 00:00:00 2025 GMT; NotAfter: Dec 20 23:59:59 2026 GMT

-----BEGIN CERTIFICATE-----

...

OWASP (Open World Application Security Project) is non-profit open source and docs.

SPIFFE and SPIRE

RFC 8693 defines how one OAuth token can be exchanged for another, typically to downscope its rights before performing a more granular action.

While KeyCloak operates at the human level, SPIFFE (workload identity standards) and SPIRE (its runtime) operate lower. 

SPIFFE rests on three concepts

1. SPIFFE ID - a URL that acts like 'username' for the container or machine.
2. SPIFFE Verifiable Identity Document (SVID) - a short lived certificate
3. An API that can give a SVID with no further protocol.

SPIRE specifies a central Server for identity and Agents running on nodes. Both the node and the process must go through a process of attestation.

IP addresses

Note that big corporations often use a CDN so when you ping them, you're probably hitting servers owned by, for example, Fastly. To see the true addresses, run somthing like:

getent hosts www.bbc.co.uk

Server Name Indication 

SNI is a field in the TLS handshake carrying the hostname the client wants to reach.

It exists because of a chicken-and-egg problem. One IP address can serve thousands of sites, each with its own certificate. The server has to choose which certificate to present, but that choice happens before there's an encrypted channel to ask over. So the client puts the hostname in the very first packet, the ClientHello, in plaintext.

The client writes its own ClientHello. Nothing stops it sending SNI good-bucket.storage.googleapis.com while the encrypted Host header says bad-bucket.storage.googleapis.com — and the server routes on Host, which the policy can't see. That's domain fronting, and it's the one hole SNI filtering can't close by itself. 

"Domain Fronting: This is the process of using multiple different domain names in the various layers of a web connection, which helps an attacker evade detection from monitoring while they quietly connect to a target." - Aligning Security Operations with the MITRE ATT&CK Framework

Zero Trust Architectures

NetBird is an open source Go tool that instead of going through a front door, transparently talks to services directly. It sits on the open source C tool, WireGuard and uses an IdP to identify the user.

Pomerium is another open source Go app that sits in front of, say, a web app and allows access based on, say, the device that's trying to connect. Other policies can be implemented like geolocation.

Key Ceremony

This is a physical event between humans where keys are exchanged under tight security.