5 ms·

I feel this is a great win in terms of security for the average consumer. Sure VPN connections within organizations may get affected but the've got a workaround

by mataug 10y ago

I feel this is a great win in terms of security for the average consumer. Sure VPN connections within organizations may get affected but the've got a workaround for that and I'm sure IT at orgs where they have an internal CA can figure it out.

Jaruzel 10y ago
The recommended path for large orgs (one of which I was recently employed at, and attached to a relevant project), is to: 1. Ensure all internal domains can also be registered externally (although the actual external registration step is optional), but this means no more .local or .companyname type TLDs internally. 2. Use an external CA to provide your certs, for both internal and external use. Obviously, this means a bit of pain[1] for existing non-standard internal domains, but with the big shift to cloud, this is less of an issue going forward. Also, external CAs will no longer provide you with a cert for internal domains that are not also able to be registered externally. -- [1]Massively understating this, of course.
- michaelt 10y ago
  Are you familiar with any CAs that will issue certs for a few hundred servers (under the same domain) that aren't on the public internet, with an automation API and at a reasonable price? Lets Encrypt isn't an option, because (a) the servers aren't on the public internet and (b) even if they were, LE is limited to 20 certificates per domain per week. I'm aware that Plex has some sort of deal like that, but is that a one-off thing, and if it's something any company can get in on, how expensive is it? I know some CAs offer 'enterprise services' but their websites don't seem to spell out what that means or what it costs - just that you should contact them to schedule a demo, which probably means the costs are eye-watering.
  - iancarroll 10y ago
    GlobalSign's CloudSSL will issue certificates with up to (IIRC) 200 SAN extensions for somewhere around $2k, but wildcard certificates will cover most use cases at a much lower price point.
    - mook 10y ago
      A wildcard is a bad idea here since one compromised host would have a certificate that works on all other hosts. A better solution would be a sub CA that's restricted to issuing certificates for that domain only, but name constraints is an extension that some (obsolete) clients might not handle correctly.
ausjke 10y ago
The only goal is to stop ad blocking with its own local CA installed, which impacts Google's revenue.

by mataug 10y ago

Jaruzel 10y ago

The recommended path for large orgs (one of which I was recently employed at, and attached to a relevant project), is to: 1. Ensure all internal domains can also be registered externally (although the actual external registration step is optional), but this means no more .local or .companyname type TLDs internally. 2. Use an external CA to provide your certs, for both internal and external use. Obviously, this means a bit of pain[1] for existing non-standard internal domains, but with the big shift to cloud, this is less of an issue going forward. Also, external CAs will no longer provide you with a cert for internal domains that are not also able to be registered externally. -- [1]Massively understating this, of course.

michaelt 10y ago
Are you familiar with any CAs that will issue certs for a few hundred servers (under the same domain) that aren't on the public internet, with an automation API and at a reasonable price? Lets Encrypt isn't an option, because (a) the servers aren't on the public internet and (b) even if they were, LE is limited to 20 certificates per domain per week. I'm aware that Plex has some sort of deal like that, but is that a one-off thing, and if it's something any company can get in on, how expensive is it? I know some CAs offer 'enterprise services' but their websites don't seem to spell out what that means or what it costs - just that you should contact them to schedule a demo, which probably means the costs are eye-watering.
- iancarroll 10y ago
  GlobalSign's CloudSSL will issue certificates with up to (IIRC) 200 SAN extensions for somewhere around $2k, but wildcard certificates will cover most use cases at a much lower price point.
  - mook 10y ago
    A wildcard is a bad idea here since one compromised host would have a certificate that works on all other hosts. A better solution would be a sub CA that's restricted to issuing certificates for that domain only, but name constraints is an extension that some (obsolete) clients might not handle correctly.

ausjke 10y ago

The only goal is to stop ad blocking with its own local CA installed, which impacts Google's revenue.