2 ms·

Why on earth would you want a third party CA to verify your own identity to you? What's the point? Just run an internal CA. For that matter a third party CA is

Why on earth would you want a third party CA to verify your own identity to you? What's the point? Just run an internal CA. For that matter a third party CA is worse, since it's an additional element in the trust chain.

djsumdog 9y ago
Exactly. You can run your own ACME compatible server internally and auto issue internal certs just like LetsEncrypt does. Then just put the company CA on your base Windows/mac images or policy, and create debs/rpms for your Linux devs/admins.
- mnx 9y ago
  This is all nice and great when you have 100s, or even just 10s of developers, but is my team of 3 really supposed to do all that?
  - bandrami 9y ago
    I mean, yes? LibreSSL is pretty easy to use. An ACME server is even easier to use. And avoiding an external certificate authority means you can avoid most of the problems that exist in the worldwide PKI to begin with. If you have an ACME-compatible server you just set up an ansible script to deploy the certs for you (I think they even provide one); it's a one-time cost of a day or so, and if your sysadmin can't set it up you've got bigger problems.
  - corford 9y ago
    Honestly, I'd only go to the effort of mimicking Letsencrypt internally if you are already using their service for prod and wanted to keep your dev environment very close to this. Here's a gist you can follow if you'd like to do things the old fashioned way (i.e. create your own Root Certificate Authority, create a Sub-Root Authority and use that to sign internal certificates): https://gist.github.com/corford/9a206664bb8278c8243821d236665d94 https://gist.github.com/corford/9a206664bb8278c8243821d23666... It's 99% copy & pasteable (doesn't assume any existing openssl.conf) and should give you decent compatibility and future proofed security. Just remember to keep the root CA safe and only use the sub-ca for signing certs.

djsumdog 9y ago

Exactly. You can run your own ACME compatible server internally and auto issue internal certs just like LetsEncrypt does. Then just put the company CA on your base Windows/mac images or policy, and create debs/rpms for your Linux devs/admins.

mnx 9y ago
This is all nice and great when you have 100s, or even just 10s of developers, but is my team of 3 really supposed to do all that?
- bandrami 9y ago
  I mean, yes? LibreSSL is pretty easy to use. An ACME server is even easier to use. And avoiding an external certificate authority means you can avoid most of the problems that exist in the worldwide PKI to begin with. If you have an ACME-compatible server you just set up an ansible script to deploy the certs for you (I think they even provide one); it's a one-time cost of a day or so, and if your sysadmin can't set it up you've got bigger problems.
- corford 9y ago
  Honestly, I'd only go to the effort of mimicking Letsencrypt internally if you are already using their service for prod and wanted to keep your dev environment very close to this. Here's a gist you can follow if you'd like to do things the old fashioned way (i.e. create your own Root Certificate Authority, create a Sub-Root Authority and use that to sign internal certificates): https://gist.github.com/corford/9a206664bb8278c8243821d236665d94 https://gist.github.com/corford/9a206664bb8278c8243821d23666... It's 99% copy & pasteable (doesn't assume any existing openssl.conf) and should give you decent compatibility and future proofed security. Just remember to keep the root CA safe and only use the sub-ca for signing certs.