3 ms·
Could WireGuard be a good choice for server-to-server encryption instead of TLS? (for example between a TLS terminating load balancer to the application servers
by borplk 7y ago
Could WireGuard be a good choice for server-to-server encryption instead of TLS? (for example between a TLS terminating load balancer to the application servers)
- kasey_junk 7y agoThat’s precisely what my favorite “smart cdn” does https://fly.io/docs/architecture/ https://fly.io/docs/architecture/
- jblwps 7y agoWhat net benefits would you see that having? If I'm allowed to assume that you wouldn't use TLS because of PKI management concerns, I have a hard time seeing how using WireGuard in the large wouldn't have the same problems--you still have to build some kind of management platform on top that verifies host authenticity (ultimately including revocations and more). That is to say, WireGuard in the large will surely (right?) need supporting PKI.
- borplk 7y agoYes mainly because of proper PKI management overhead. Wouldn't Wireguard work with a simple shared secret on both ends?