4 ms·
That seems like a case where a reverse proxy like NGINX[1] would be useful. The configuration would basically be: User->HTTPS over public internet->NGINX->HTTP
by alexhutcheson 6y ago
That seems like a case where a reverse proxy like NGINX[1] would be useful. The configuration would basically be:
User->HTTPS over public internet->NGINX->HTTP on your private network->Custom appliances
The most vulnerable link (the public internet part) would still be encrypted, and browsers won't show the scary warnings. The HTTP connection would be confined to your private network, where MITM is less of a concern.
You can use one NGINX instance to reverse proxy multiple different appliances, so the maintenance overhead wouldn't be that high.
[1] https://docs.nginx.com/nginx/admin-guide/web-server/reverse-proxy/ https://docs.nginx.com/nginx/admin-guide/web-server/reverse-...
- at_a_remove 6y agoIt's funny you should mention that. A new guy (who has since left) who was super into the Let's Encrypt thing before running up against the org policy of only using a certain certificate vendor, got excited about the "problem," used NGINX, and then had to take it down for reasons I wasn't privy to. I didn't look into the reasons why.
- dicknuckle 6y agoProbably stepped on some toes. If they're not familiar with LE, it's because they think anything free has a catch, or they're just ignorant and want to keep sending money to Norton because that's the antivirus that came with their computer all those years ago.
- at_a_remove 6y agoOh, the guy who wanted NGINX was familiar with Let's Encrypt, but the org-wide policy was set somewhere far, far away from either of us. The approved vendor changed at least twice that I can recall.