Office setups: Deploy an internal root CA (possibly with appropriate name constraints, to limit the damage to internal domains if your CA key is compromised). A

Office setups: Deploy an internal root CA (possibly with appropriate name constraints, to limit the damage to internal domains if your CA key is compromised). Active Directory makes it relatively easy to do this. Tooling will hopefully get better now that browsers are pretty much set on going HTTPS-only. Some consumer devices could probably implement something similar to what Plex did to deploy TLS [1]. I do agree that the industry isn't where it should be yet, but hopefully everyone's feeling the pressure now. :) [1]: https://blog.filippo.io/how-plex-is-doing-https-for-all-its-users/ https://blog.filippo.io/how-plex-is-doing-https-for-all-its-...