reinitialized.net/infrastructure
2
0
Fork 0
Code Issues 37 Pull requests Projects Releases Packages Wiki Activity Actions

[MEDIUM] ACME PFX certificates exported with empty password #25

New issue
Open
opened 2026-05-05 15:44:47 -05:00 by pjennings · 0 comments
pjennings commented 2026-05-05 15:44:47 -05:00
Owner
Copy link

Labels: area:security, area:network, priority:medium, type:enhancement

Description

ACME certificate generation uses --pfx.pass= (empty password) for PKCS#12 certificates in:

  • hosts/apps1.nix (one.dns.reinitialized.net)
  • hosts/apps2.nix (two.dns.reinitialized.net)
  • hosts/rp1.nix (all ACME certs)

Impact

Anyone who obtains the PFX file can use the private key without any password. If the file is exposed through a misconfigured service or backup, the TLS private key is compromised.

Recommended Fix

Set a strong password for PFX files, stored in the secrets management system.

**Labels:** area:security, area:network, priority:medium, type:enhancement ## Description ACME certificate generation uses --pfx.pass= (empty password) for PKCS#12 certificates in: - hosts/apps1.nix (one.dns.reinitialized.net) - hosts/apps2.nix (two.dns.reinitialized.net) - hosts/rp1.nix (all ACME certs) ## Impact Anyone who obtains the PFX file can use the private key without any password. If the file is exposed through a misconfigured service or backup, the TLS private key is compromised. ## Recommended Fix Set a strong password for PFX files, stored in the secrets management system.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
indev
No results found.
Labels
Clear labels   
area:documentation

Documentation, inventory, runbooks

  
area:infrastructure

Infrastructure services and hardware

  
area:network

Network, firewall, and connectivity

  
area:security

Security vulnerabilities and findings

  
priority:critical

Fix immediately — active risk

  
priority:high

Fix within 1-2 weeks

  
priority:low

Backlog — hardening and best practices

  
priority:medium

Fix within 1 month

  
status:blocked

Blocked on dependency or decision

  
type:bug

Misconfiguration or broken behavior

  
type:deployment

New service or system deployment

  
type:enhancement

Improvement or hardening

  
type:investigation

Needs research or identification

No labels
area:documentation
area:infrastructure
area:network
area:security
priority:critical
priority:high
priority:low
priority:medium
status:blocked
type:bug
type:deployment
type:enhancement
type:investigation
Milestone
Clear milestone
No items
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
reinitialized.net/infrastructure#25
No description provided.