5 ms·
This is a ridiculous requirement that is not at all practical.
by lawnchair_larry 6y ago
This is a ridiculous requirement that is not at all practical.
- gsich 6y agoYou can also run your own CA.
- geerlingguy 6y ago> This is a ridiculous requirement that is not at all practical.
- gsich 6y agoFor a company? Absolutely not. In private? Probably not worth the effort, just skip the cert warning.
- nitrogen 6y agoMost hardware in this category really needs to be set-and-forget, whether online or not. You can't have every random sound system and light controller having to dial out to a third party every month. You need to be able to come back five years later and still be able to configure the hardware.
- rad_gruchalski 6y agoReally. This: https://jamielinux.com/docs/openssl-certificate-authority/ https://jamielinux.com/docs/openssl-certificate-authority/ gives you a CA in about an hour. HashiCorp Vault will give you a CA in 5 minutes. certstrap will give you a CA in 15 seconds. It’s 2020, it ain’t voodoo anymore.
- Karunamon 6y agoJust spinning up a CA is a couple of commands. Running one sanely (to include security of the private keys, availability and auditability of the signing machine, keeping backups, publishing a CRL, setting up ACME if you want any kind of automation) is significantly more involved.
- Spivak 6y agoBut this is silly. If this isn’t completely trivial to add to your app then something has gone horribly wrong. * Every machine in your infra already has backups, right? Nothing about your signing boxes are special in this regard. * All your services are already HA, right? The API servers that now have to run some glorified OpenSSL commands aren’t any different than your normal API endpoints. * You already have to protect secrets on your machines. DB passwords, API keys. What’s one more? * You don’t have to implement ACME. These are your devices talking to your devices.
- rad_gruchalski 6y agoNothing different than any long lived component in any infrastructure. There is no reason to look for reasons not to use a CA.
- slenk 6y agoHow is it not practical? It's really not hard to set up and there is great documentation out there
- orev 6y agoI get the feeling you have no real experience either running a company network or dealing with end users and home networks. Any of these solutions work fine for a majority of people who just use their laptop in Starbucks, but they really break down when you need to start doing anything more complicated than that.
- slenk 6y agoPlease, educate me as to what I am overlooking. The requirements of buying a domain name and getting a LE wildcard cert should be trivial to someone with the experience you seem to have.
- imtringued 6y agoWhy would the average customer of IoT products have the same expertise as the person you are replying to?
- TwoNineFive 6y agoAll of these juvinile "It's easy! just implement ${SUPER COMPLICATED INFRASTRUCTURE WITH SPECIFIC REQUIREMENTS AND LIMITATIONS I'M GOING TO TO PRETEND AWAY}" replies from eager-idiot hacker tweens is just trolling.