3 ms·
If you don't expose your intranet resources to the outside world, you can probably set up your CA. With proper measures (non-exportable key on a HSM, stored in
by drdaeman 10y ago
If you don't expose your intranet resources to the outside world, you can probably set up your CA.
With proper measures (non-exportable key on a HSM, stored in a safe, requires a PIN that only senior security staff knows, etc etc), it may even improve security for some attack scenarios - if someone gains control of your DNS servers for a short while, they won't be able to issue anything.
- yeukhon 10y agoCan you elaborate where does the HSM come into play with the DNS verification? I am not following. thanks.
- drdaeman 10y agoI was comparing two possible scenarios: a) you have set up your own internal CA, which key is safely stored on an HSM, with all security measures. b) you use Let's Encrypt, and they issue you certificates based on DNS validation. With (b) if malicious party gains control over your DNS server, they can issue themselves a bunch of valid certificates that you may not even know about (unless you watch CT records). With (a) remote attacker barely has a chance. Thus, a self-hosted CA may be beneficial in terms of security.