3 ms·
This is all nice and great when you have 100s, or even just 10s of developers, but is my team of 3 really supposed to do all that?
by mnx 9y ago
This is all nice and great when you have 100s, or even just 10s of developers, but is my team of 3 really supposed to do all that?
- bandrami 9y agoI mean, yes? LibreSSL is pretty easy to use. An ACME server is even easier to use. And avoiding an external certificate authority means you can avoid most of the problems that exist in the worldwide PKI to begin with. If you have an ACME-compatible server you just set up an ansible script to deploy the certs for you (I think they even provide one); it's a one-time cost of a day or so, and if your sysadmin can't set it up you've got bigger problems.
- corford 9y agoHonestly, I'd only go to the effort of mimicking Letsencrypt internally if you are already using their service for prod and wanted to keep your dev environment very close to this. Here's a gist you can follow if you'd like to do things the old fashioned way (i.e. create your own Root Certificate Authority, create a Sub-Root Authority and use that to sign internal certificates): https://gist.github.com/corford/9a206664bb8278c8243821d236665d94 https://gist.github.com/corford/9a206664bb8278c8243821d23666... It's 99% copy & pasteable (doesn't assume any existing openssl.conf) and should give you decent compatibility and future proofed security. Just remember to keep the root CA safe and only use the sub-ca for signing certs.