Managed corporate access client
Native Windows and macOS clients with signed policy · update trust pinned to the issuing CA
What was built
Windows and macOS clients for corporate access, plus the policy panel behind them. The server signs policy with ECDSA P-256, the client checks it with an embedded key. Update trust is pinned to the issuing CA, not a thumbprint. Pin the thumbprint and one reissue kills updates fleet-wide. I keep machine data and the user profile apart. Panel login is a domain account, over Kerberos. Tests went from 31 to 175. All in production.
Stack
.NET 8Swift / AppKitWiX / MSImacOS pkgECDSA P-256Kerberos / SPNEGOAuthenticode
Other work
- Single source of truth for infrastructure
- 2FA / SSO for mail on Keycloak + ANGIE
- Enterprise infrastructure from scratch
- Internal certificate authority with ACME
- Report access gateway on directory groups
- Workplace self-service: software and VDI
- Active Directory hygiene: GPO repair
- Active Directory modernization
- Zabbix + Grafana and automation
- Office-to-DC networking
- Virtualization and vCenter
- Distributed Veeam and DRP
- Infrastructure Q&A agent over MCP
- Multi-agent workflow for solo development
- LLM call analysis and BI/CRM pipeline