If you’re at all serious about security and not user convenience, you deploy BitLocker with a PIN instead of TPM only. And then a whole class of vulnerabilities goes away.
> Put the phone in their pocket and it felt a press and went into edit mode and edited the lock screen.
This is why I hate the flashlight and camera buttons on the lock screen - which you can activate without unlocking. When you have your hands in your pockets during cold weather you’ll suddenly be ”filming”… I never use the camera on my phone anyway. Thankfully at some point they added support for removing them.
Amazon/AWS Registrar. They're a reseller for Gandi, but of course everything is managed through AWS and the pricing is at-cost instead of the rip-off that Gandi is now.
Orchestrate the renewal with Ansible - renew on the "master" server remotely but pull the new key material to your orchestrator and then push them to your server fleet. That's what I do. It's not "clean" or "ideal" to my tastes, but it works.
It also occurred to me that there's nothing(?) preventing you from concurrently having n valid certificates for a particular hostname, so you could just enroll distinct certificates for each host. Provided the validation could be handled somehow.
The other option would maybe be doing DNS-based validation from a single orchestrator and then pushing that result onto the entire fleet.
DNS-based (hostname) allowlisting is just starting to hit the market (see: Microsoft's "Zero Trust DNS" [1]) and this would kill that. Even traditional proxy-based access control is neutered by this and the nice thing about that is that it can be done without TLS interception.
If you're left with only path-based rules you're back to TLS interception if you want to control network access.
> Unix was very much made for multi user environments. ... The biggest security concern was making sure that everyone who was logged in was billed correctly.
I don't know about that... It doesn't even support multiple administrators. And you can't even distinguish between actions performed by the system itself and the administrative user.
Yes I know about sudo.
What do you need to do and what do the (even audit) logs say about who performed an activity whenever administrative activity happens?
Finland did cross the old borders in parts, but we specifically didn’t participate in the Siege of Leningrad and refused all German demands for assistance.