4 ms·

In my corporate environment, we are prohibited from using HTTP but we do not require our certificates to be up to date. Since the proxy does not allow Internet

In my corporate environment, we are prohibited from using HTTP but we do not require our certificates to be up to date. Since the proxy does not allow Internet access except to a whitelist of hosts, we have to do something like this in order to take an ubuntu iso from a vendor, and convert it into an os template that my company can use: echo "Acquire::http::Proxy \"http://personal-cntlm-proxy:3128\";" http://personal-cntlm-proxy:3128\";" > /etc/apt/apt.conf apt-get install -y apt-transport-https echo "deb [trusted=yes] https://someserver/somedir https://someserver/somedir bionic main universe multiverse" > /etc/apt/sources.list echo "deb [trusted=yes] https://someserver/somedir https://someserver/somedir bionic-updates main universe multiverse" >> /etc/apt/sources.list echo "deb [trusted=yes] https://someserver/somedir https://someserver/somedir bionic-security main universe multiverse" >> /etc/apt/sources.list echo "Acquire::https::Verify-Peer \"false\";" > /etc/apt/apt.conf.d/80ssl-exceptions echo "Acquire::https::Verify-Host \"false\";" >> /etc/apt/apt.conf.d/80ssl-exceptions apt-get -y install ca-certificates # and now the server is trusted finally echo "deb https://someserver/somedir https://someserver/somedir bionic main universe multiverse" > /etc/apt/sources.list echo "deb https://someserver/somedir https://someserver/somedir bionic-updates main universe multiverse" >> /etc/apt/sources.list echo "deb https://someserver/somedir https://someserver/somedir bionic-security main universe multiverse" >> /etc/apt/sources.list rm /etc/apt/apt.conf.d/80ssl-exceptions probably not even anywhere near the prescribed way to do this, but everything in corporate america has a few extra dance steps.

ldng 7y ago
Not to pound on you digitalsushi, I don't imagine you have a say in the policy, but .. "we are prohibited from using HTTP but we do not require our certificates to be up to date" WHAT'S THE F%@#ING POINT if you do not require proper certificate ?!?! I've been saying for many years that the HTTPS everywhere is not a good idea and would end up in false sens of security. It's like green-washing; everybody pretend doing it except not really .... Luckly, in the case of Apt it does not matter much but there are other cases of blind-https-all-the-thing-stupidly where it does.
- digitalsushi 7y ago
  No offense taken, there's a large city's worth of people at this company. I definitely have nothing to do with the TLS governance board's policies. There are so many competing, parallel efforts to solve problems, that generally everything is a bit mediocre in terms of what is available. It requires a bit of a forced-optimist persona to remain creative and upbeat. On the other hand, when I go back to a small company, the sense of technical freedom should feel remarkable.

ldng 7y ago

Not to pound on you digitalsushi, I don't imagine you have a say in the policy, but .. "we are prohibited from using HTTP but we do not require our certificates to be up to date" WHAT'S THE F%@#ING POINT if you do not require proper certificate ?!?! I've been saying for many years that the HTTPS everywhere is not a good idea and would end up in false sens of security. It's like green-washing; everybody pretend doing it except not really .... Luckly, in the case of Apt it does not matter much but there are other cases of blind-https-all-the-thing-stupidly where it does.

digitalsushi 7y ago
No offense taken, there's a large city's worth of people at this company. I definitely have nothing to do with the TLS governance board's policies. There are so many competing, parallel efforts to solve problems, that generally everything is a bit mediocre in terms of what is available. It requires a bit of a forced-optimist persona to remain creative and upbeat. On the other hand, when I go back to a small company, the sense of technical freedom should feel remarkable.