<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>I've been able to automate DNSSEC on my own systems.<br>
DNSSEC is automated at the SLD's in ZA-Land - and keys are held in
real HSM's - which are secure.</p>
<p>I've been able to automate working with SSL Certificates with
Let's Encrypt. This had to be automated as the Certificates are
renewed every two month and I have a large number of web and some
e-mail sites using SSL certificates.<br>
SSL Certificates combined with DNSSEC means I also run DANE.<br>
<br>
It must be possible to automate - even if it means connecting a
timer switch to the machine to power up the Offline CA server.
Once up - it should be able to then power up a usually dead
Ethernet port with internal only IP addresses - etc - at a
particular time to transfer the necessary files - that is - the
switching on (and off) and file copy can be<b> initiated from
inside </b>the secured location automatically and autonomously.
Isn't that what the human operators are meant to, as such, do?</p>
<p>Please think out of the box - I have an automated watering system
that waters the garden at night, switching on a bore hole and then
passing the water through nine different watering circuits, some
for 20 minutes and others for ten minutes - but only if the ground
is initially dry (as in no recent rain). You should be able to get
a stand-alone (not controlled by a computer) switch that will turn
on once a month. <br>
</p>
<p>Automation should be preferred over human intervention. The
scripts I run generate quite a lot of debugging/tracing output -
so I can see that everything runs OK and will defer actual updates
if checks are not passed. If necessary, I can then intervene.<br>
</p>
<p>Getting DNSSEC to work reliably took a year or so and working
with Let's Encrypt also took the best part of a year - as neither
are daily events.<br>
Automation over time should be possible though.<br>
<br>
Note; the only DNSSEC that I still have to process manually is
when updating DS records at AFRINIC for number resources via the
my.afrinic website. <span class="moz-smiley-s2"><span>:-(</span></span><br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 2019/04/10 21:29, Noah wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAEqgTWaLqu9SekxhWJMsOywYhRXEuPspTvOD6Y8Bn6eGGr-Vvg@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div dir="ltr"><br>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Wed, Apr 10, 2019 at
10:25 PM Amreesh Phokeer <<a
href="mailto:amreesh@afrinic.net" moz-do-not-send="true">amreesh@afrinic.net</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">Hi Noah,<br>
<br>
> On 10 Apr 2019, at 23:13, Noah <<a
href="mailto:noah@neo.co.tz" target="_blank"
moz-do-not-send="true">noah@neo.co.tz</a>> wrote:<br>
> <br>
> Just curious could a bash/python script + cron locally
on the Offline CA box achieve the same level of automation
monthly without any manual intervention from humans. <br>
> <br>
> The human manual involvement can still be automated
local to the same offline box imho.<br>
<br>
No because: <br>
(1) the Offline CA is kept offline (shutdown) in a secured
environment and brought up only at the time of the refresh.<br>
</blockquote>
<div><br>
</div>
<div>There is not way to automate this bruh....</div>
<div> <br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
(2) the box is not physically connected, so the CRLs and
MFTs files need to be copied manually to the online
repository.<br>
</blockquote>
<div><br>
</div>
<div>Understood.... in this case the humans need to be
automated so that they are more efficient until such time
when the robots will replace humans :-)</div>
<div> <br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<br>
—<br>
Amreesh</blockquote>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
RPKI-Discuss mailing list
<a class="moz-txt-link-abbreviated" href="mailto:RPKI-Discuss@afrinic.net">RPKI-Discuss@afrinic.net</a>
<a class="moz-txt-link-freetext" href="https://lists.afrinic.net/mailman/listinfo/rpki-discuss">https://lists.afrinic.net/mailman/listinfo/rpki-discuss</a>
</pre>
</blockquote>
<pre class="moz-signature" cols="72">--
Mark James ELKINS - Posix Systems - (South) Africa
<a class="moz-txt-link-abbreviated" href="mailto:mje@posix.co.za">mje@posix.co.za</a> Tel: +27.128070590 Cell: +27.826010496
For fast, reliable, low cost Internet in ZA: <a class="moz-txt-link-freetext" href="https://ftth.posix.co.za">https://ftth.posix.co.za</a>
</pre>
</body>
</html>