3 ms·

What? No; that's ridiculous. Running an internal CA is absolutely the right thing to do in almost any situation. Why on earth would you let a third party insert

What? No; that's ridiculous. Running an internal CA is absolutely the right thing to do in almost any situation. Why on earth would you let a third party insert itself into your internal trust relationships?

user5994461 9y ago
Yes, every company should have an internal trusted CA. I have no idea why there are people arguing against that.
- ithkuil 9y ago
  Unfortunately it's not possible to limit the ability of that CA to create valid certificates for any arbitrary domain, at least not on all platforms, see https://bugs.chromium.org/p/chromium/issues/detail?id=407093 https://bugs.chromium.org/p/chromium/issues/detail?id=407093
  - bandrami 9y ago
    And? What's the problem there?
    - ithkuil 9y ago
      if you install a company internal CA, a rogue syadmin can create perfectly valid certificates for any domain,.including your bank's
      - bandrami 9y ago
        Which is a perfect example of why you shouldn't use work equipment for personal traffic.
        ithkuil 9y ago
        Or, you are the CEO/CFO/whatever and don't want syadmins of one particular department to compromise your access to your company's bank account. I think you're oversimplifying. There are other scenarios you can imagine where it's not a good idea to let one security domain bleed into another.
        ithkuil 9y ago
        edit: also, since android 7.0, user defined CA certificates work only on apps that explicitly allow it (source: https://support.google.com/nexus/answer/2844832?hl=en https://support.google.com/nexus/answer/2844832?hl=en)
        bandrami 9y ago
        All the more reason you wouldn't let a third party CA sign certificates for your bank. Seriously, this is and has always been the weakest point of PKI. We have known instances of bad google.com certificates in the wild, as well as certificates being backdated to meet hash requirements. An internal CA is simply not the problem here, particularly since you can audit your admins' actions.
        ithkuil 9y ago
        >> [..] Yes, every company should have an internal trusted CA. I have no idea why there are people arguing against that. > An internal CA is simply not the problem here, particularly since you can audit your admins' actions. If you can properly audit your admins' actions, then that's indeed not a problem. It's easier said than done; I just tried to mention a few reasons why a lot of people suggest (IMHO rightfully so) that perhaps it's not something just about every company should do. In particular, it's you don't just have to ensure that the CA is properly defended from outside threats only. Before letsencrypt we didn't have any choice, but now the landscape is really different and in many cases I believe a company could easily defer dealing with an internal CA, especially after https://letsencrypt.org/2017/07/06/wildcard-certificates-coming-jan-2018.html https://letsencrypt.org/2017/07/06/wildcard-certificates-com... FWIW, certificate pinning (HPKP) and efforts like Certificate Transparency are attempts to address or at least mitigate weaknesses of the PKI system.

user5994461 9y ago

Yes, every company should have an internal trusted CA. I have no idea why there are people arguing against that.

ithkuil 9y ago
Unfortunately it's not possible to limit the ability of that CA to create valid certificates for any arbitrary domain, at least not on all platforms, see https://bugs.chromium.org/p/chromium/issues/detail?id=407093 https://bugs.chromium.org/p/chromium/issues/detail?id=407093
- bandrami 9y ago
  And? What's the problem there?
  - ithkuil 9y ago
    if you install a company internal CA, a rogue syadmin can create perfectly valid certificates for any domain,.including your bank's
    - bandrami 9y ago
      Which is a perfect example of why you shouldn't use work equipment for personal traffic.
      - ithkuil 9y ago
        Or, you are the CEO/CFO/whatever and don't want syadmins of one particular department to compromise your access to your company's bank account. I think you're oversimplifying. There are other scenarios you can imagine where it's not a good idea to let one security domain bleed into another.
        ithkuil 9y ago
        edit: also, since android 7.0, user defined CA certificates work only on apps that explicitly allow it (source: https://support.google.com/nexus/answer/2844832?hl=en https://support.google.com/nexus/answer/2844832?hl=en)
        bandrami 9y ago
        All the more reason you wouldn't let a third party CA sign certificates for your bank. Seriously, this is and has always been the weakest point of PKI. We have known instances of bad google.com certificates in the wild, as well as certificates being backdated to meet hash requirements. An internal CA is simply not the problem here, particularly since you can audit your admins' actions.
        ithkuil 9y ago
        >> [..] Yes, every company should have an internal trusted CA. I have no idea why there are people arguing against that. > An internal CA is simply not the problem here, particularly since you can audit your admins' actions. If you can properly audit your admins' actions, then that's indeed not a problem. It's easier said than done; I just tried to mention a few reasons why a lot of people suggest (IMHO rightfully so) that perhaps it's not something just about every company should do. In particular, it's you don't just have to ensure that the CA is properly defended from outside threats only. Before letsencrypt we didn't have any choice, but now the landscape is really different and in many cases I believe a company could easily defer dealing with an internal CA, especially after https://letsencrypt.org/2017/07/06/wildcard-certificates-coming-jan-2018.html https://letsencrypt.org/2017/07/06/wildcard-certificates-com... FWIW, certificate pinning (HPKP) and efforts like Certificate Transparency are attempts to address or at least mitigate weaknesses of the PKI system.