4 ms·

There are more benign uses too - many organisations run an internal PKI, and installing their root CA prevents employees' browsers from displaying warnings abo

There are more benign uses too - many organisations run an internal PKI, and installing their root CA prevents employees' browsers from displaying warnings about untrusted certificates when accessing internal web apps/sites.

worldofmatthew 7y ago
You might be able to make intranet.company-name.tld and have a parking page on the company-name.tld and use that to get a wildcard cert that can be used for the internal pages.
- isostatic 7y ago
  Which you distribute to thousands of people on tens of thousands of devices?
  - worldofmatthew 7y ago
    With this you would have a vaild cert for your intranet aka no need to install a self-signed one.
    - isostatic 7y ago
      However you would have a single wildcart cert + key that would need to be placed on thousands, or tens of thousands, of machines, by hundreds of staff is dozens of departments. It would be meaningless. I can prove ownership and then receive a wildcard certificate for *.internal.company.com, usually by a TXT record or similar (lets ignore EV certs for now), however that certificate isn't an intermediate certificate which is limited to signing new end certificates for blah1.internal.company.com, but wouldn't be able to sign for blah1.not.company.com. I'm no SSL/TLS expert by any means, so please let me know if I'm wrong and it is fairly easy to get intermediate certificates that are domain name limited - x509 constraints are apparently flakey.
vbezhenar 7y ago
That would be a bad use IMO. Letsencrypt solves any need for legitimate certificates.
- layoutIfNeeded 7y ago
  Lol. Sure, company sysadmins will run certbot on their mainframes.
  - vbezhenar 7y ago
    There are plenty of clients for letsencrypt, including even Bash ones. That should not be a problem.
    - michaelt 7y ago
      Letsencrypt only issues certs for publicly accessible hosts. If you've got a bunch of intranet servers / REST services / whatever that are firewalled from the public internet, you're out of luck.
      - jupp0r 7y ago
        Thats incorrect, you can verify using DNS zone records, so the server can be as firewalled or air gapped as you want.
- cat199 7y ago
  > Letsencrypt solves any need for legitimate certificates. ... unless you want any private keys to be personally signed and or generated by bob & alice over in security after checking some boxes in an internal audit form, or any other number of company-internal schemes involving signing and encryption of business-specific data
  - vbezhenar 7y ago
    You're generating private key securely. You're generating CSR which contains public key and signed by that private key and now you need to move that CSR from private location to a public location. But that's not bad, it does not contain anything that could be compromised and your private key is kept safe. Then you're using letsencrypt to issue that certificate using that CSR and keep using that CSR (it does not expire) to renew certificate. All that time private key is kept in safety and is only used by your webserver. Letsencrypt allows you to generate legitimate certificate for internal websites without any compromise on security. The only use-case that's not possible with Letsencrypt is to issue certificate for IP address.

worldofmatthew 7y ago

You might be able to make intranet.company-name.tld and have a parking page on the company-name.tld and use that to get a wildcard cert that can be used for the internal pages.

isostatic 7y ago
Which you distribute to thousands of people on tens of thousands of devices?
- worldofmatthew 7y ago
  With this you would have a vaild cert for your intranet aka no need to install a self-signed one.
  - isostatic 7y ago
    However you would have a single wildcart cert + key that would need to be placed on thousands, or tens of thousands, of machines, by hundreds of staff is dozens of departments. It would be meaningless. I can prove ownership and then receive a wildcard certificate for *.internal.company.com, usually by a TXT record or similar (lets ignore EV certs for now), however that certificate isn't an intermediate certificate which is limited to signing new end certificates for blah1.internal.company.com, but wouldn't be able to sign for blah1.not.company.com. I'm no SSL/TLS expert by any means, so please let me know if I'm wrong and it is fairly easy to get intermediate certificates that are domain name limited - x509 constraints are apparently flakey.

vbezhenar 7y ago

That would be a bad use IMO. Letsencrypt solves any need for legitimate certificates.

layoutIfNeeded 7y ago
Lol. Sure, company sysadmins will run certbot on their mainframes.
- vbezhenar 7y ago
  There are plenty of clients for letsencrypt, including even Bash ones. That should not be a problem.
  - michaelt 7y ago
    Letsencrypt only issues certs for publicly accessible hosts. If you've got a bunch of intranet servers / REST services / whatever that are firewalled from the public internet, you're out of luck.
    - jupp0r 7y ago
      Thats incorrect, you can verify using DNS zone records, so the server can be as firewalled or air gapped as you want.
cat199 7y ago
> Letsencrypt solves any need for legitimate certificates. ... unless you want any private keys to be personally signed and or generated by bob & alice over in security after checking some boxes in an internal audit form, or any other number of company-internal schemes involving signing and encryption of business-specific data
- vbezhenar 7y ago
  You're generating private key securely. You're generating CSR which contains public key and signed by that private key and now you need to move that CSR from private location to a public location. But that's not bad, it does not contain anything that could be compromised and your private key is kept safe. Then you're using letsencrypt to issue that certificate using that CSR and keep using that CSR (it does not expire) to renew certificate. All that time private key is kept in safety and is only used by your webserver. Letsencrypt allows you to generate legitimate certificate for internal websites without any compromise on security. The only use-case that's not possible with Letsencrypt is to issue certificate for IP address.