3 ms·
> I understand how disruptive this would be, but in the end it would result in better security for everyone. I disagree. I could quite easily see this resultin
by stordoff 7y ago
> I understand how disruptive this would be, but in the end it would result in better security for everyone.
I disagree. I could quite easily see this resulting in companies using old browser versions, or hacking in a potentially exploitable way to get MITM access. An enterprise CA is at least a fairly well-known and understood risk.
I also don't see why I shouldn't be able to have an internal CA for my internal services.
- jupp0r 7y ago> I also don't see why I shouldn't be able to have an internal CA for my internal services. Because this enables every player in the system to issue valid certificates for bankofamerica.com and rob their bank accounts? It's easy and cheap nowadays to get regular certificates for your internal services with letsencrypt.
- amaccuish 7y ago> Because this enables every player in the system to issue valid certificates for bankofamerica.com and rob their bank accounts? No it doesn't. The CA has to be installed for the certificate to be valid. It only enables one "player", the CA you choose, to do that. Internal CAs are still important. It's not always possible to have outbound access to Letsencrypt or register every single machine in external DNS.
- stordoff 7y agoIf something can install a root CA on my system, I feel like I've already lost.