>Self-signing is a great way to invite phishing attacks against your end users: if they're used to clicking through cert warnings all the time, they won't notic

>Self-signing is a great way to invite phishing attacks against your end users: if they're used to clicking through cert warnings all the time, they won't notice when something has actually gone wrong. Sure, it's most suitable for a homelab where you can import the certs, with suitable discretion, for yourself only. >Running your own CA works but has two caveats: first, I don't really trust myself to run a CA competently given that almost nobody who runs a CA as their only business function is doing so competently Not a massive concern since the context is internal only, but I hear you. >and second, you have to get your config onto every device on the network. Yep, this can be tricky in a less controlled environment. I had two scenarios in my mind - Home lab, and enterprise, when I penned that response. There's definitely a third one here, that you have in mind, that I didn't cover. >It's quite a bit simpler and more secure to just use .corp.example.com or whatever. Definitely the best option for small to medium companies.