)]}'
{"docs/ephemeralPKI.rst":[{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"de93219b31275e94c12a63957063a5c7c30a6232","unresolved":false,"context_lines":[{"line_number":30,"context_line":"tends to scale very poorly, while this workflow may have sufficed for managing"},{"line_number":31,"context_line":"the certificate that an organization might want to provision to it\u0027s edge to"},{"line_number":32,"context_line":"provide secure web services, it cannot cope with the massive numbers of"},{"line_number":33,"context_line":"certificates required for running large data-centers."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Methods for automatically issuing certificates such as SCEP and ADCS"},{"line_number":36,"context_line":"auto-enrollment exist to help solve this problem but often require significant"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_3e158848","line":33,"updated":"2015-09-02 20:12:13.000000000","message":"One paragraph sentence.","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"3baf60f50ddccc9b30a0c99f1326264c0206e4a2","unresolved":false,"context_lines":[{"line_number":30,"context_line":"tends to scale very poorly, while this workflow may have sufficed for managing"},{"line_number":31,"context_line":"the certificate that an organization might want to provision to it\u0027s edge to"},{"line_number":32,"context_line":"provide secure web services, it cannot cope with the massive numbers of"},{"line_number":33,"context_line":"certificates required for running large data-centers."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Methods for automatically issuing certificates such as SCEP and ADCS"},{"line_number":36,"context_line":"auto-enrollment exist to help solve this problem but often require significant"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_9ec92baf","line":33,"in_reply_to":"da20952f_3e158848","updated":"2015-09-02 23:32:17.000000000","message":"Done","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"de93219b31275e94c12a63957063a5c7c30a6232","unresolved":false,"context_lines":[{"line_number":35,"context_line":"Methods for automatically issuing certificates such as SCEP and ADCS"},{"line_number":36,"context_line":"auto-enrollment exist to help solve this problem but often require significant"},{"line_number":37,"context_line":"architectural changes to use them securely. For example, SCEP requires a"},{"line_number":38,"context_line":"secure network to work (if you had such a network you wouldn\u0027t need"},{"line_number":39,"context_line":"certificates) so is typically only used when infrastructure is provisioned -"},{"line_number":40,"context_line":"before being moved into production. ADCS auto-enrollment requires all of your"},{"line_number":41,"context_line":"servers to be running on Microsoft Windows, which is often not the case for"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_39a842db","line":38,"updated":"2015-09-02 20:12:13.000000000","message":"how about \u0027in most cases, if you had such a network...\u0027","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"3baf60f50ddccc9b30a0c99f1326264c0206e4a2","unresolved":false,"context_lines":[{"line_number":35,"context_line":"Methods for automatically issuing certificates such as SCEP and ADCS"},{"line_number":36,"context_line":"auto-enrollment exist to help solve this problem but often require significant"},{"line_number":37,"context_line":"architectural changes to use them securely. For example, SCEP requires a"},{"line_number":38,"context_line":"secure network to work (if you had such a network you wouldn\u0027t need"},{"line_number":39,"context_line":"certificates) so is typically only used when infrastructure is provisioned -"},{"line_number":40,"context_line":"before being moved into production. ADCS auto-enrollment requires all of your"},{"line_number":41,"context_line":"servers to be running on Microsoft Windows, which is often not the case for"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_becc2fbc","line":38,"in_reply_to":"da20952f_39a842db","updated":"2015-09-02 23:32:17.000000000","message":"Done","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"de93219b31275e94c12a63957063a5c7c30a6232","unresolved":false,"context_lines":[{"line_number":36,"context_line":"auto-enrollment exist to help solve this problem but often require significant"},{"line_number":37,"context_line":"architectural changes to use them securely. For example, SCEP requires a"},{"line_number":38,"context_line":"secure network to work (if you had such a network you wouldn\u0027t need"},{"line_number":39,"context_line":"certificates) so is typically only used when infrastructure is provisioned -"},{"line_number":40,"context_line":"before being moved into production. ADCS auto-enrollment requires all of your"},{"line_number":41,"context_line":"servers to be running on Microsoft Windows, which is often not the case for"},{"line_number":42,"context_line":"large scale cloud-type environments."}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_f9aacad1","line":39,"updated":"2015-09-02 20:12:13.000000000","message":"it is","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"3baf60f50ddccc9b30a0c99f1326264c0206e4a2","unresolved":false,"context_lines":[{"line_number":36,"context_line":"auto-enrollment exist to help solve this problem but often require significant"},{"line_number":37,"context_line":"architectural changes to use them securely. For example, SCEP requires a"},{"line_number":38,"context_line":"secure network to work (if you had such a network you wouldn\u0027t need"},{"line_number":39,"context_line":"certificates) so is typically only used when infrastructure is provisioned -"},{"line_number":40,"context_line":"before being moved into production. ADCS auto-enrollment requires all of your"},{"line_number":41,"context_line":"servers to be running on Microsoft Windows, which is often not the case for"},{"line_number":42,"context_line":"large scale cloud-type environments."}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_fe3947a4","line":39,"in_reply_to":"da20952f_f9aacad1","updated":"2015-09-02 23:32:17.000000000","message":"Done","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"de93219b31275e94c12a63957063a5c7c30a6232","unresolved":false,"context_lines":[{"line_number":66,"context_line":"each machine, if configured to do so, can independently request it\u0027s own"},{"line_number":67,"context_line":"certificate with separate credentials allows Anchor to make very fine grained"},{"line_number":68,"context_line":"decisions regarding which machines should be given certificates, allowing"},{"line_number":69,"context_line":"administrators to focus on policies for certificate issuing. There\u0027s more"},{"line_number":70,"context_line":"information on Anchor authentication in the :doc:`../configuration` section."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Along with fine grained access control Anchor supports various"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_f9c96a7a","line":69,"updated":"2015-09-02 20:12:13.000000000","message":"Long and messy sentence","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"3baf60f50ddccc9b30a0c99f1326264c0206e4a2","unresolved":false,"context_lines":[{"line_number":66,"context_line":"each machine, if configured to do so, can independently request it\u0027s own"},{"line_number":67,"context_line":"certificate with separate credentials allows Anchor to make very fine grained"},{"line_number":68,"context_line":"decisions regarding which machines should be given certificates, allowing"},{"line_number":69,"context_line":"administrators to focus on policies for certificate issuing. There\u0027s more"},{"line_number":70,"context_line":"information on Anchor authentication in the :doc:`../configuration` section."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Along with fine grained access control Anchor supports various"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_fe2e2741","line":69,"in_reply_to":"da20952f_f9c96a7a","updated":"2015-09-02 23:32:17.000000000","message":"Done","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"de93219b31275e94c12a63957063a5c7c30a6232","unresolved":false,"context_lines":[{"line_number":69,"context_line":"administrators to focus on policies for certificate issuing. There\u0027s more"},{"line_number":70,"context_line":"information on Anchor authentication in the :doc:`../configuration` section."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Along with fine grained access control Anchor supports various"},{"line_number":73,"context_line":":doc:`../validators` that can be used by PKI administrators to set tight policy"},{"line_number":74,"context_line":"constraints on what is allowed within a certificate. These validators provide a"},{"line_number":75,"context_line":"powerful construct for programmatically verifying that a certificate meets"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_b9c3f256","line":72,"updated":"2015-09-02 20:12:13.000000000","message":",","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"3baf60f50ddccc9b30a0c99f1326264c0206e4a2","unresolved":false,"context_lines":[{"line_number":69,"context_line":"administrators to focus on policies for certificate issuing. There\u0027s more"},{"line_number":70,"context_line":"information on Anchor authentication in the :doc:`../configuration` section."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Along with fine grained access control Anchor supports various"},{"line_number":73,"context_line":":doc:`../validators` that can be used by PKI administrators to set tight policy"},{"line_number":74,"context_line":"constraints on what is allowed within a certificate. These validators provide a"},{"line_number":75,"context_line":"powerful construct for programmatically verifying that a certificate meets"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_5e4b932b","line":72,"in_reply_to":"da20952f_b9c3f256","updated":"2015-09-02 23:32:17.000000000","message":"Done","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"de93219b31275e94c12a63957063a5c7c30a6232","unresolved":false,"context_lines":[{"line_number":87,"context_line":"within dynamic, large scale environments. CRLs are updated only periodically"},{"line_number":88,"context_line":"and have significant scale issues when used within systems that change"},{"line_number":89,"context_line":"certificates regularly. OCSP was created to address a number of the issues that"},{"line_number":90,"context_line":"hinder CRLs but unfortunately are very poorly supported in cryptographic"},{"line_number":91,"context_line":"libraries outside of web-browser software. Using OCSP incurs some"},{"line_number":92,"context_line":"infrastructure overhead because it needs to maintain a level of availability"},{"line_number":93,"context_line":"that normally requires it to be load balanced to ensure that a responder is"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_b99a126d","line":90,"updated":"2015-09-02 20:12:13.000000000","message":"s/are/is","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"3baf60f50ddccc9b30a0c99f1326264c0206e4a2","unresolved":false,"context_lines":[{"line_number":87,"context_line":"within dynamic, large scale environments. CRLs are updated only periodically"},{"line_number":88,"context_line":"and have significant scale issues when used within systems that change"},{"line_number":89,"context_line":"certificates regularly. OCSP was created to address a number of the issues that"},{"line_number":90,"context_line":"hinder CRLs but unfortunately are very poorly supported in cryptographic"},{"line_number":91,"context_line":"libraries outside of web-browser software. Using OCSP incurs some"},{"line_number":92,"context_line":"infrastructure overhead because it needs to maintain a level of availability"},{"line_number":93,"context_line":"that normally requires it to be load balanced to ensure that a responder is"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_9e25ab5d","line":90,"in_reply_to":"da20952f_b99a126d","updated":"2015-09-02 23:32:17.000000000","message":"Done","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"de93219b31275e94c12a63957063a5c7c30a6232","unresolved":false,"context_lines":[{"line_number":97,"context_line":".. _CRL: https://www.ietf.org/rfc/rfc5280.txt"},{"line_number":98,"context_line":".. _OCSP: https://tools.ietf.org/html/rfc6960"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"To recap; CRLs don\u0027t work terribly well in large scale, dynamic environments"},{"line_number":101,"context_line":"where multiple certificates might be required in a machines lifetime as it is"},{"line_number":102,"context_line":"repurposed. OCSP doesn\u0027t work outside of web browsers and is of little value"},{"line_number":103,"context_line":"as a revocation system for large scale infrastructure."}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_19b0dedc","line":100,"updated":"2015-09-02 20:12:13.000000000","message":"do not work effectively","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"3baf60f50ddccc9b30a0c99f1326264c0206e4a2","unresolved":false,"context_lines":[{"line_number":97,"context_line":".. _CRL: https://www.ietf.org/rfc/rfc5280.txt"},{"line_number":98,"context_line":".. _OCSP: https://tools.ietf.org/html/rfc6960"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"To recap; CRLs don\u0027t work terribly well in large scale, dynamic environments"},{"line_number":101,"context_line":"where multiple certificates might be required in a machines lifetime as it is"},{"line_number":102,"context_line":"repurposed. OCSP doesn\u0027t work outside of web browsers and is of little value"},{"line_number":103,"context_line":"as a revocation system for large scale infrastructure."}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_1e1afb17","line":100,"in_reply_to":"da20952f_19b0dedc","updated":"2015-09-02 23:32:17.000000000","message":"Done","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"de93219b31275e94c12a63957063a5c7c30a6232","unresolved":false,"context_lines":[{"line_number":98,"context_line":".. _OCSP: https://tools.ietf.org/html/rfc6960"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"To recap; CRLs don\u0027t work terribly well in large scale, dynamic environments"},{"line_number":101,"context_line":"where multiple certificates might be required in a machines lifetime as it is"},{"line_number":102,"context_line":"repurposed. OCSP doesn\u0027t work outside of web browsers and is of little value"},{"line_number":103,"context_line":"as a revocation system for large scale infrastructure."},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_d9ca664f","line":101,"updated":"2015-09-02 20:12:13.000000000","message":"machine\u0027s","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"3baf60f50ddccc9b30a0c99f1326264c0206e4a2","unresolved":false,"context_lines":[{"line_number":98,"context_line":".. _OCSP: https://tools.ietf.org/html/rfc6960"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"To recap; CRLs don\u0027t work terribly well in large scale, dynamic environments"},{"line_number":101,"context_line":"where multiple certificates might be required in a machines lifetime as it is"},{"line_number":102,"context_line":"repurposed. OCSP doesn\u0027t work outside of web browsers and is of little value"},{"line_number":103,"context_line":"as a revocation system for large scale infrastructure."},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_ded24334","line":101,"in_reply_to":"da20952f_d9ca664f","updated":"2015-09-02 23:32:17.000000000","message":"Done","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"de93219b31275e94c12a63957063a5c7c30a6232","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Passive Revocation"},{"line_number":106,"context_line":"------------------"},{"line_number":107,"context_line":"Anchor issues very short lifetime certificates, typically Anchor will be"},{"line_number":108,"context_line":"configured to provide a certificate with just 12-24 hour certificate lifetimes."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Rather than attempting to actively revoke a \"live\" certificate Anchor instead"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_99db8e1b","line":107,"updated":"2015-09-02 20:12:13.000000000","message":"Anchor issues very short lifetime certificates, typically just 12-24 hours.","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"3baf60f50ddccc9b30a0c99f1326264c0206e4a2","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Passive Revocation"},{"line_number":106,"context_line":"------------------"},{"line_number":107,"context_line":"Anchor issues very short lifetime certificates, typically Anchor will be"},{"line_number":108,"context_line":"configured to provide a certificate with just 12-24 hour certificate lifetimes."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Rather than attempting to actively revoke a \"live\" certificate Anchor instead"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_1ef19bcd","line":107,"in_reply_to":"da20952f_99db8e1b","updated":"2015-09-02 23:32:17.000000000","message":"Done","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"de93219b31275e94c12a63957063a5c7c30a6232","unresolved":false,"context_lines":[{"line_number":107,"context_line":"Anchor issues very short lifetime certificates, typically Anchor will be"},{"line_number":108,"context_line":"configured to provide a certificate with just 12-24 hour certificate lifetimes."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Rather than attempting to actively revoke a \"live\" certificate Anchor instead"},{"line_number":111,"context_line":"refuses to re-issue a certificate to bad machine/user. The assumption being"},{"line_number":112,"context_line":"that a change in policy, or modification to the authentication platform is all"},{"line_number":113,"context_line":"that is required to ensure that a bad actor cannot gain access to certificates."}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_19353e45","line":110,"updated":"2015-09-02 20:12:13.000000000","message":"can probably remove \u0027live\u0027. maybe add a comma after \u0027certificate\u0027","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"3baf60f50ddccc9b30a0c99f1326264c0206e4a2","unresolved":false,"context_lines":[{"line_number":107,"context_line":"Anchor issues very short lifetime certificates, typically Anchor will be"},{"line_number":108,"context_line":"configured to provide a certificate with just 12-24 hour certificate lifetimes."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Rather than attempting to actively revoke a \"live\" certificate Anchor instead"},{"line_number":111,"context_line":"refuses to re-issue a certificate to bad machine/user. The assumption being"},{"line_number":112,"context_line":"that a change in policy, or modification to the authentication platform is all"},{"line_number":113,"context_line":"that is required to ensure that a bad actor cannot gain access to certificates."}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_dea003a8","line":110,"in_reply_to":"da20952f_19353e45","updated":"2015-09-02 23:32:17.000000000","message":"Done","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"de93219b31275e94c12a63957063a5c7c30a6232","unresolved":false,"context_lines":[{"line_number":108,"context_line":"configured to provide a certificate with just 12-24 hour certificate lifetimes."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Rather than attempting to actively revoke a \"live\" certificate Anchor instead"},{"line_number":111,"context_line":"refuses to re-issue a certificate to bad machine/user. The assumption being"},{"line_number":112,"context_line":"that a change in policy, or modification to the authentication platform is all"},{"line_number":113,"context_line":"that is required to ensure that a bad actor cannot gain access to certificates."},{"line_number":114,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_79155a99","line":111,"updated":"2015-09-02 20:12:13.000000000","message":"_a_ bad machine _or_ user.","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"3baf60f50ddccc9b30a0c99f1326264c0206e4a2","unresolved":false,"context_lines":[{"line_number":108,"context_line":"configured to provide a certificate with just 12-24 hour certificate lifetimes."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Rather than attempting to actively revoke a \"live\" certificate Anchor instead"},{"line_number":111,"context_line":"refuses to re-issue a certificate to bad machine/user. The assumption being"},{"line_number":112,"context_line":"that a change in policy, or modification to the authentication platform is all"},{"line_number":113,"context_line":"that is required to ensure that a bad actor cannot gain access to certificates."},{"line_number":114,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_5e95d33d","line":111,"in_reply_to":"da20952f_79155a99","updated":"2015-09-02 23:32:17.000000000","message":"Done","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"de93219b31275e94c12a63957063a5c7c30a6232","unresolved":false,"context_lines":[{"line_number":116,"context_line":"compromise when a \"bad\" certificate may still be used within the system."},{"line_number":117,"context_line":"Although this may seem like a sub-optimal way to handle revocation it actually"},{"line_number":118,"context_line":"results in better performance than more traditional revocation techniques. As"},{"line_number":119,"context_line":"discussed earlier, CRLs can be unreliable and OCSP isn\u0027t supported outside of"},{"line_number":120,"context_line":"web servers. However, even if it were, the passive revocation window typically"},{"line_number":121,"context_line":"employed by anchor will be shorter than the OCSP cached response when using an"},{"line_number":122,"context_line":"OCSP responder. This means that in most typical configurations, using Anchor"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_b9721210","line":119,"updated":"2015-09-02 20:12:13.000000000","message":"s/isn\u0027t/is generally not","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"3baf60f50ddccc9b30a0c99f1326264c0206e4a2","unresolved":false,"context_lines":[{"line_number":116,"context_line":"compromise when a \"bad\" certificate may still be used within the system."},{"line_number":117,"context_line":"Although this may seem like a sub-optimal way to handle revocation it actually"},{"line_number":118,"context_line":"results in better performance than more traditional revocation techniques. As"},{"line_number":119,"context_line":"discussed earlier, CRLs can be unreliable and OCSP isn\u0027t supported outside of"},{"line_number":120,"context_line":"web servers. However, even if it were, the passive revocation window typically"},{"line_number":121,"context_line":"employed by anchor will be shorter than the OCSP cached response when using an"},{"line_number":122,"context_line":"OCSP responder. This means that in most typical configurations, using Anchor"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_9eafeb7c","line":119,"in_reply_to":"da20952f_b9721210","updated":"2015-09-02 23:32:17.000000000","message":"Done","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"de93219b31275e94c12a63957063a5c7c30a6232","unresolved":false,"context_lines":[{"line_number":117,"context_line":"Although this may seem like a sub-optimal way to handle revocation it actually"},{"line_number":118,"context_line":"results in better performance than more traditional revocation techniques. As"},{"line_number":119,"context_line":"discussed earlier, CRLs can be unreliable and OCSP isn\u0027t supported outside of"},{"line_number":120,"context_line":"web servers. However, even if it were, the passive revocation window typically"},{"line_number":121,"context_line":"employed by anchor will be shorter than the OCSP cached response when using an"},{"line_number":122,"context_line":"OCSP responder. This means that in most typical configurations, using Anchor"},{"line_number":123,"context_line":"will result in more reliable and timely certificate revocation than any other"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_994e2ec0","line":120,"updated":"2015-09-02 20:12:13.000000000","message":"s/servers/browsers?","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"3baf60f50ddccc9b30a0c99f1326264c0206e4a2","unresolved":false,"context_lines":[{"line_number":117,"context_line":"Although this may seem like a sub-optimal way to handle revocation it actually"},{"line_number":118,"context_line":"results in better performance than more traditional revocation techniques. As"},{"line_number":119,"context_line":"discussed earlier, CRLs can be unreliable and OCSP isn\u0027t supported outside of"},{"line_number":120,"context_line":"web servers. However, even if it were, the passive revocation window typically"},{"line_number":121,"context_line":"employed by anchor will be shorter than the OCSP cached response when using an"},{"line_number":122,"context_line":"OCSP responder. This means that in most typical configurations, using Anchor"},{"line_number":123,"context_line":"will result in more reliable and timely certificate revocation than any other"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_5ecab350","line":120,"in_reply_to":"da20952f_994e2ec0","updated":"2015-09-02 23:32:17.000000000","message":"Done","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":11397,"name":"Doug Chivers","email":"dougchivers@gmail.com","username":"dg"},"change_message_id":"de93219b31275e94c12a63957063a5c7c30a6232","unresolved":false,"context_lines":[{"line_number":118,"context_line":"results in better performance than more traditional revocation techniques. As"},{"line_number":119,"context_line":"discussed earlier, CRLs can be unreliable and OCSP isn\u0027t supported outside of"},{"line_number":120,"context_line":"web servers. However, even if it were, the passive revocation window typically"},{"line_number":121,"context_line":"employed by anchor will be shorter than the OCSP cached response when using an"},{"line_number":122,"context_line":"OCSP responder. This means that in most typical configurations, using Anchor"},{"line_number":123,"context_line":"will result in more reliable and timely certificate revocation than any other"},{"line_number":124,"context_line":"mechanism available today."}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_19d1becd","line":121,"updated":"2015-09-02 20:12:13.000000000","message":"Anchor","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"3baf60f50ddccc9b30a0c99f1326264c0206e4a2","unresolved":false,"context_lines":[{"line_number":118,"context_line":"results in better performance than more traditional revocation techniques. As"},{"line_number":119,"context_line":"discussed earlier, CRLs can be unreliable and OCSP isn\u0027t supported outside of"},{"line_number":120,"context_line":"web servers. However, even if it were, the passive revocation window typically"},{"line_number":121,"context_line":"employed by anchor will be shorter than the OCSP cached response when using an"},{"line_number":122,"context_line":"OCSP responder. This means that in most typical configurations, using Anchor"},{"line_number":123,"context_line":"will result in more reliable and timely certificate revocation than any other"},{"line_number":124,"context_line":"mechanism available today."}],"source_content_type":"text/x-rst","patch_set":7,"id":"da20952f_7ec5373b","line":121,"in_reply_to":"da20952f_19d1becd","updated":"2015-09-02 23:32:17.000000000","message":"Done","commit_id":"0e55eb3bee6db0a8621cb69f3cdedde41f76b9c7"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"42b93a07eb8ef6076fb6ca57f24753263aad7d5b","unresolved":false,"context_lines":[{"line_number":28,"context_line":""},{"line_number":29,"context_line":"This heavily manual process is fraught with opportunities for human error and"},{"line_number":30,"context_line":"tends to scale very poorly. This workflow may have sufficed for managing the"},{"line_number":31,"context_line":"certificates that an organization might want to provision to it\u0027s edge to"},{"line_number":32,"context_line":"provide secure web services, it cannot cope with the massive numbers of"},{"line_number":33,"context_line":"certificates required for running large data-centers."},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_c414b24e","line":31,"updated":"2015-09-03 00:43:06.000000000","message":"The \"...to ... to...\" is awkward, and the it\u0027s should be its.\n\nMaybe \"...that an organization may want at its edge in order to provide secure web services...\"?","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b12f7f3d2cde76c8ced99ade494e13da73761e06","unresolved":false,"context_lines":[{"line_number":28,"context_line":""},{"line_number":29,"context_line":"This heavily manual process is fraught with opportunities for human error and"},{"line_number":30,"context_line":"tends to scale very poorly. This workflow may have sufficed for managing the"},{"line_number":31,"context_line":"certificates that an organization might want to provision to it\u0027s edge to"},{"line_number":32,"context_line":"provide secure web services, it cannot cope with the massive numbers of"},{"line_number":33,"context_line":"certificates required for running large data-centers."},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_c50330b7","line":31,"in_reply_to":"da20952f_c414b24e","updated":"2015-09-03 15:22:22.000000000","message":"Done","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"42b93a07eb8ef6076fb6ca57f24753263aad7d5b","unresolved":false,"context_lines":[{"line_number":29,"context_line":"This heavily manual process is fraught with opportunities for human error and"},{"line_number":30,"context_line":"tends to scale very poorly. This workflow may have sufficed for managing the"},{"line_number":31,"context_line":"certificates that an organization might want to provision to it\u0027s edge to"},{"line_number":32,"context_line":"provide secure web services, it cannot cope with the massive numbers of"},{"line_number":33,"context_line":"certificates required for running large data-centers."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Methods for automatically issuing certificates such as SCEP and ADCS"}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_3802720a","line":32,"updated":"2015-09-03 00:43:06.000000000","message":"number","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b12f7f3d2cde76c8ced99ade494e13da73761e06","unresolved":false,"context_lines":[{"line_number":29,"context_line":"This heavily manual process is fraught with opportunities for human error and"},{"line_number":30,"context_line":"tends to scale very poorly. This workflow may have sufficed for managing the"},{"line_number":31,"context_line":"certificates that an organization might want to provision to it\u0027s edge to"},{"line_number":32,"context_line":"provide secure web services, it cannot cope with the massive numbers of"},{"line_number":33,"context_line":"certificates required for running large data-centers."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Methods for automatically issuing certificates such as SCEP and ADCS"}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_251c6c12","line":32,"in_reply_to":"da20952f_3802720a","updated":"2015-09-03 15:22:22.000000000","message":"Done","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"42b93a07eb8ef6076fb6ca57f24753263aad7d5b","unresolved":false,"context_lines":[{"line_number":35,"context_line":"Methods for automatically issuing certificates such as SCEP and ADCS"},{"line_number":36,"context_line":"auto-enrollment exist to help solve this problem but often require significant"},{"line_number":37,"context_line":"architectural changes to use them securely. For example, SCEP requires a"},{"line_number":38,"context_line":"secure network to work (in most cases, if you had such a network you wouldn\u0027t"},{"line_number":39,"context_line":"need certificates) so it is typically only used when infrastructure is"},{"line_number":40,"context_line":"provisioned - before being moved into production. ADCS auto-enrollment requires"},{"line_number":41,"context_line":"all of  your servers to be running on Microsoft Windows, which is often not the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_f822baa2","line":38,"updated":"2015-09-03 00:43:06.000000000","message":"again, not a fan of the redundancy of \u0027you\u0027\n\nMaybe: \"in most cases, if such a network already existed then certificates would not be necessary\"?","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b12f7f3d2cde76c8ced99ade494e13da73761e06","unresolved":false,"context_lines":[{"line_number":35,"context_line":"Methods for automatically issuing certificates such as SCEP and ADCS"},{"line_number":36,"context_line":"auto-enrollment exist to help solve this problem but often require significant"},{"line_number":37,"context_line":"architectural changes to use them securely. For example, SCEP requires a"},{"line_number":38,"context_line":"secure network to work (in most cases, if you had such a network you wouldn\u0027t"},{"line_number":39,"context_line":"need certificates) so it is typically only used when infrastructure is"},{"line_number":40,"context_line":"provisioned - before being moved into production. ADCS auto-enrollment requires"},{"line_number":41,"context_line":"all of  your servers to be running on Microsoft Windows, which is often not the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_85a1b8ab","line":38,"in_reply_to":"da20952f_f822baa2","updated":"2015-09-03 15:22:22.000000000","message":"Done","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"42b93a07eb8ef6076fb6ca57f24753263aad7d5b","unresolved":false,"context_lines":[{"line_number":42,"context_line":"case for large scale cloud-type environments."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Anchor provides an alternative mechanism for provisioning certificates that"},{"line_number":45,"context_line":"allows each server in a cluster to request it\u0027s own certificate while"},{"line_number":46,"context_line":"enforcing strong issuing policies that introduce capabilities beyond those that"},{"line_number":47,"context_line":"can be leveraged by the manual process described above - and it can do it at"},{"line_number":48,"context_line":"large scale."}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_f8707aa6","line":45,"updated":"2015-09-03 00:43:06.000000000","message":"again it\u0027s -\u003e its","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b12f7f3d2cde76c8ced99ade494e13da73761e06","unresolved":false,"context_lines":[{"line_number":42,"context_line":"case for large scale cloud-type environments."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Anchor provides an alternative mechanism for provisioning certificates that"},{"line_number":45,"context_line":"allows each server in a cluster to request it\u0027s own certificate while"},{"line_number":46,"context_line":"enforcing strong issuing policies that introduce capabilities beyond those that"},{"line_number":47,"context_line":"can be leveraged by the manual process described above - and it can do it at"},{"line_number":48,"context_line":"large scale."}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_c59fb05d","line":45,"in_reply_to":"da20952f_f8707aa6","updated":"2015-09-03 15:22:22.000000000","message":"Done","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"42b93a07eb8ef6076fb6ca57f24753263aad7d5b","unresolved":false,"context_lines":[{"line_number":62,"context_line":".. _Certmonger: https://fedorahosted.org/certmonger/"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Anchor provides multiple ways for machines to authenticate. Primarily LDAP,"},{"line_number":65,"context_line":"Keystone and a pre-shared Username/Password combination. As every machine in a"},{"line_number":66,"context_line":"data centre can potentially have it\u0027s own set of credentials Anchor can make"},{"line_number":67,"context_line":"very fine grained decisions regarding which machines should be given trusted at"},{"line_number":68,"context_line":"any given time. There\u0027s more information on Anchor authentication in the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_d87b367a","line":65,"updated":"2015-09-03 00:43:06.000000000","message":"Primarily...combination is now a sentence fragment.\n\nMaybe:\n\"The current supported options are LDAP, Keystone, and pre-shared username/password combinations.\"","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b12f7f3d2cde76c8ced99ade494e13da73761e06","unresolved":false,"context_lines":[{"line_number":62,"context_line":".. _Certmonger: https://fedorahosted.org/certmonger/"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Anchor provides multiple ways for machines to authenticate. Primarily LDAP,"},{"line_number":65,"context_line":"Keystone and a pre-shared Username/Password combination. As every machine in a"},{"line_number":66,"context_line":"data centre can potentially have it\u0027s own set of credentials Anchor can make"},{"line_number":67,"context_line":"very fine grained decisions regarding which machines should be given trusted at"},{"line_number":68,"context_line":"any given time. There\u0027s more information on Anchor authentication in the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_851218b3","line":65,"in_reply_to":"da20952f_d87b367a","updated":"2015-09-03 15:22:22.000000000","message":"Done","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"42b93a07eb8ef6076fb6ca57f24753263aad7d5b","unresolved":false,"context_lines":[{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Anchor provides multiple ways for machines to authenticate. Primarily LDAP,"},{"line_number":65,"context_line":"Keystone and a pre-shared Username/Password combination. As every machine in a"},{"line_number":66,"context_line":"data centre can potentially have it\u0027s own set of credentials Anchor can make"},{"line_number":67,"context_line":"very fine grained decisions regarding which machines should be given trusted at"},{"line_number":68,"context_line":"any given time. There\u0027s more information on Anchor authentication in the"},{"line_number":69,"context_line":":doc:`../configuration` section."}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_788b0a69","line":66,"updated":"2015-09-03 00:43:06.000000000","message":"its","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b12f7f3d2cde76c8ced99ade494e13da73761e06","unresolved":false,"context_lines":[{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Anchor provides multiple ways for machines to authenticate. Primarily LDAP,"},{"line_number":65,"context_line":"Keystone and a pre-shared Username/Password combination. As every machine in a"},{"line_number":66,"context_line":"data centre can potentially have it\u0027s own set of credentials Anchor can make"},{"line_number":67,"context_line":"very fine grained decisions regarding which machines should be given trusted at"},{"line_number":68,"context_line":"any given time. There\u0027s more information on Anchor authentication in the"},{"line_number":69,"context_line":":doc:`../configuration` section."}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_a515dc9b","line":66,"in_reply_to":"da20952f_788b0a69","updated":"2015-09-03 15:22:22.000000000","message":"Done","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"42b93a07eb8ef6076fb6ca57f24753263aad7d5b","unresolved":false,"context_lines":[{"line_number":64,"context_line":"Anchor provides multiple ways for machines to authenticate. Primarily LDAP,"},{"line_number":65,"context_line":"Keystone and a pre-shared Username/Password combination. As every machine in a"},{"line_number":66,"context_line":"data centre can potentially have it\u0027s own set of credentials Anchor can make"},{"line_number":67,"context_line":"very fine grained decisions regarding which machines should be given trusted at"},{"line_number":68,"context_line":"any given time. There\u0027s more information on Anchor authentication in the"},{"line_number":69,"context_line":":doc:`../configuration` section."},{"line_number":70,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_b8d8c280","line":67,"updated":"2015-09-03 00:43:06.000000000","message":"should be given trusted at? Should be trusted at?","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b12f7f3d2cde76c8ced99ade494e13da73761e06","unresolved":false,"context_lines":[{"line_number":64,"context_line":"Anchor provides multiple ways for machines to authenticate. Primarily LDAP,"},{"line_number":65,"context_line":"Keystone and a pre-shared Username/Password combination. As every machine in a"},{"line_number":66,"context_line":"data centre can potentially have it\u0027s own set of credentials Anchor can make"},{"line_number":67,"context_line":"very fine grained decisions regarding which machines should be given trusted at"},{"line_number":68,"context_line":"any given time. There\u0027s more information on Anchor authentication in the"},{"line_number":69,"context_line":":doc:`../configuration` section."},{"line_number":70,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_a5639c40","line":67,"in_reply_to":"da20952f_b8d8c280","updated":"2015-09-03 15:22:22.000000000","message":"Done","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"843c6792e97bb76d9f7075def2607e6c719c59cb","unresolved":false,"context_lines":[{"line_number":66,"context_line":"data centre can potentially have it\u0027s own set of credentials Anchor can make"},{"line_number":67,"context_line":"very fine grained decisions regarding which machines should be given trusted at"},{"line_number":68,"context_line":"any given time. There\u0027s more information on Anchor authentication in the"},{"line_number":69,"context_line":":doc:`../configuration` section."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Along with fine grained access control Anchor, supports various"},{"line_number":72,"context_line":":doc:`../validators` that can be used by PKI administrators to set tight policy"}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_38635243","line":69,"updated":"2015-09-03 00:57:07.000000000","message":"This works without the \"../\" - I think it\u0027s not throwing errors, because it\u0027s already top level, but better to fix it properly.","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b12f7f3d2cde76c8ced99ade494e13da73761e06","unresolved":false,"context_lines":[{"line_number":66,"context_line":"data centre can potentially have it\u0027s own set of credentials Anchor can make"},{"line_number":67,"context_line":"very fine grained decisions regarding which machines should be given trusted at"},{"line_number":68,"context_line":"any given time. There\u0027s more information on Anchor authentication in the"},{"line_number":69,"context_line":":doc:`../configuration` section."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Along with fine grained access control Anchor, supports various"},{"line_number":72,"context_line":":doc:`../validators` that can be used by PKI administrators to set tight policy"}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_455ac084","line":69,"in_reply_to":"da20952f_38635243","updated":"2015-09-03 15:22:22.000000000","message":"Done","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"843c6792e97bb76d9f7075def2607e6c719c59cb","unresolved":false,"context_lines":[{"line_number":69,"context_line":":doc:`../configuration` section."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Along with fine grained access control Anchor, supports various"},{"line_number":72,"context_line":":doc:`../validators` that can be used by PKI administrators to set tight policy"},{"line_number":73,"context_line":"constraints on what is allowed within a certificate. These validators provide a"},{"line_number":74,"context_line":"powerful construct for programmatically verifying that a certificate meets"},{"line_number":75,"context_line":"policy requirements for a particular environment."}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_f85cfa7e","line":72,"updated":"2015-09-03 00:57:07.000000000","message":"same here","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b12f7f3d2cde76c8ced99ade494e13da73761e06","unresolved":false,"context_lines":[{"line_number":69,"context_line":":doc:`../configuration` section."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Along with fine grained access control Anchor, supports various"},{"line_number":72,"context_line":":doc:`../validators` that can be used by PKI administrators to set tight policy"},{"line_number":73,"context_line":"constraints on what is allowed within a certificate. These validators provide a"},{"line_number":74,"context_line":"powerful construct for programmatically verifying that a certificate meets"},{"line_number":75,"context_line":"policy requirements for a particular environment."}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_0555a84e","line":72,"in_reply_to":"da20952f_f85cfa7e","updated":"2015-09-03 15:22:22.000000000","message":"Done","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"42b93a07eb8ef6076fb6ca57f24753263aad7d5b","unresolved":false,"context_lines":[{"line_number":104,"context_line":"Passive Revocation"},{"line_number":105,"context_line":"------------------"},{"line_number":106,"context_line":"Anchor issues very short lifetime certificates, typically certificates will be"},{"line_number":107,"context_line":"issued with a lifetime just 12-24 hours."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Rather than attempting to actively revoke a certificate in the tradition sense,"},{"line_number":110,"context_line":"Anchor will refuse to re-issue a certificate to a bad machine or user. The"}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_18376eb1","line":107,"updated":"2015-09-03 00:43:06.000000000","message":"lifetime of","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b12f7f3d2cde76c8ced99ade494e13da73761e06","unresolved":false,"context_lines":[{"line_number":104,"context_line":"Passive Revocation"},{"line_number":105,"context_line":"------------------"},{"line_number":106,"context_line":"Anchor issues very short lifetime certificates, typically certificates will be"},{"line_number":107,"context_line":"issued with a lifetime just 12-24 hours."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Rather than attempting to actively revoke a certificate in the tradition sense,"},{"line_number":110,"context_line":"Anchor will refuse to re-issue a certificate to a bad machine or user. The"}],"source_content_type":"text/x-rst","patch_set":8,"id":"da20952f_a0770a9e","line":107,"in_reply_to":"da20952f_18376eb1","updated":"2015-09-03 15:22:22.000000000","message":"Done","commit_id":"ba8aaa94671e74a1e4318fe8f33ea4cf9d7d89ff"}]}