2 ms·

Some companies do, many don't. I don't recommend running your own CA unless you have a very good reason to do so. It's complicated and it introduces additional

• ehPReth 9y ago
  If one absolutely must regardless please use name/IP constraints! Client support isn't super awesome from what I understand but it's much better than having an unconstrained root ('keys to the internet') on >1 client - especially if you can't go the nines to protect said key.
  • bandrami 9y ago
    Wow, you guys have very different use cases from me. We do all internal authentication through server and client certificates. I'm still astounded that people seem to want a third party to participate in internal trust relationships, which seems just like a really bad idea to me.
    • detaro 9y ago
      They don't want a third party in internal trust relationships, but they want to avoid their internal trust being used to attack their communications with the outside even more. Locally added CA certs override even features such as key pinning, so if your local CA gets compromised it can be used to MITM everything. Not everyone trusts themselves to run a CA safely enough, or to make it properly available to developers.
• bandrami 9y ago
  What? No; that's ridiculous. Running an internal CA is absolutely the right thing to do in almost any situation. Why on earth would you let a third party insert itself into your internal trust relationships?
  • user5994461 9y ago
    Yes, every company should have an internal trusted CA. I have no idea why there are people arguing against that.
    • ithkuil 9y ago
      Unfortunately it's not possible to limit the ability of that CA to create valid certificates for any arbitrary domain, at least not on all platforms, see https://bugs.chromium.org/p/chromium/issues/detail?id=407093 https://bugs.chromium.org/p/chromium/issues/detail?id=407093
      • bandrami 9y ago
        And? What's the problem there?
        • ithkuil 9y ago
          if you install a company internal CA, a rogue syadmin can create perfectly valid certificates for any domain,.including your bank's
          • bandrami 9y ago
            Which is a perfect example of why you shouldn't use work equipment for personal traffic.
            • ithkuil 9y ago
              Or, you are the CEO/CFO/whatever and don't want syadmins of one particular department to compromise your access to your company's bank account. I think you're oversimplifying. There are other scenarios you can imagine where it's not a good idea to let one security domain bleed into another.
              • 9y ago