Keep my blog updated

作者昨晚去了Boon Lay购物,虽然没有找到合适的书籍,但成功购买了用于修理鞋子的速干胶。途中遇到一位陌生女孩对他微笑,让他感到有些困惑。早晨醒来感觉有点冷,不过考虑到新加坡的气候,这种情况并不常见。

there's not so much stuff to say. just keep my blog updated.

i went to boon lay to buy something yesterday night. and when i arrived there, it's nearly 7 pm. i planned to buy some books to read first. so i managed to get the bookstore for a quick browsing. ufortunately, i found nothing matches my requirements. so, i went out and headed for the FairPrice supermarket for a bottle of super glue. i need it to repair my shoes. and thanks god, i found it quickly. it cost me 2.79 S$.

on the way back, i met a girl. she smiledto me. it's so weired. i didn't know her before. so i checked myself quickly for any incorrectness, but found nothing. and she passed. i knew i'll never know. just forgot it.

i woke up this morning very early. and found myself a little cold. but i didn't pay much attention to it. singapore is a place that doesn't agree with cold.

我是一个网络安全工程师。请帮我解读一个研发的证书方案的邮件,我需要双向证书认证建立的HTTPS,客户端需要存储服务端的证书(或公钥),存储自己证书的私钥(安全存储),然后服务端需要有客户端帧数或者公钥,服务端有自己的私钥。关键是需要证书轮换机制,服务器的证书一年一换,但需要把证书安全更新到客户端,同时客户端也需要跟新,有更新机制即可,不需要频繁。 需要解析的邮件内容: Let me try to answer the questions from your email to Lynda. >> details about onboard CA (Navis Server CA, Kingwaytek CDN CA) • I have attached the CA chain files which we would use to verify CDN server (attachment 1) and Navis BE Server (attachment 2). i. Pls. note that the Navis Server CA might change by end of this year, as we will renew the server cert to fulfill your requirement “RSA bitlength >2048”. >> storage solution for encr.PK and CA • CA files and client certs including the encrypted private key will be stored in the App’s private (internal) storage. • The password for the client cert will be stored in the Application code itself by using some obfuscation mechanism. >> update management Let me summarize the Navis download mechanism which I sketched in my previous email from June 5th: • Navis will digitally sign the CA/client certs and upload them to CDN (including the CA cert to access CDN for downloading map data to the device). • Renewed certificates will be uploaded to the CDN server by Navis, timely before the expiration date. • The App will check for updated certificates on the CDN on regular basis (once per day) OR immediately in case a TLS failure occurs. • The App will download the certs from CDN via insecure access (encrypted HTTPS communication, but no server certificate check) to prevent accidental lock-outs. • The App will verify the digital signature of each downloaded certificate. • In case the downloaded certificate would not work (e.g. wrong file uploaded to server, file corrupted during download), the App would keep using the installed certificate and retry the download a couple of times. • Firstly, the App will try to use the newly downloaded certificate to establish a connection to the corresponding BE. • If a BE connection fails during TLS handshake (certificate check), the App would keep on using the old certificate file from the local storage, assuming that the new certificate is either wrong or got corrupted during download. • Then, the App would trigger a download retry pattern, i.e. it would retry to download the certificate files a few seconds later, and again some minutes later etc. • Once a successful connection is established with the downloaded certificate, it will be installed into the App’s internal storage. • The certificate files in the App’s local storage will only be updated if the BE connection with the new certificate succeeded. ->This fail-safe mechanism assures that the App can always connect to the BEs, and any interruption can be recovered ASAP. >> timeline I am not quite sure what you mean exactly, but • Certificates will be renewed 2-4 weeks before their expiration date. • Navis will inform all stakeholders 1 month before the expiration date. • Day&time of the exchange procedure will be aligned with all stakeholders. • After the change is applied, all stakeholders are informed so that they can perform necessary tests. • In case of Navis BE server certificate renewal, the change will be applied to the STAGING environment first. • After STAGING environment is confirmed working fine, the change will be applied to PROD environment. • Client certificates will be valid for 6 years. • Server certificates are typically valid for 1 year. • CA certificates are typically valid for 10~20 years.
09-06
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值