4 ms·

This sounds like it could work. Since it's a workplace server and is only accessed internally by workplace-issued machines (which are always on the workplace VP

This sounds like it could work. Since it's a workplace server and is only accessed internally by workplace-issued machines (which are always on the workplace VPN), I think there might be some sort of public cert already in place. Guess I just have to hunt down a certificate!

JoshTriplett 6y ago
It's still preferable to use a real DNS name and a real certificate, if you possibly can, which means that nobody has to install a CA. There's currently no way on any modern system, as far as I'm aware, to install a CA but limit it to only a specific domain and its subdomains; any CA you install can issue a certificate for any domain. (There are theoretically some certificate extensions that allow limiting a certificate to subdomains, but as far as I can tell, implementations don't reliably support those extensions.)