3 ms·

You can also run your own CA.

• geerlingguy 6y ago
  > This is a ridiculous requirement that is not at all practical.
  • gsich 6y ago
    For a company? Absolutely not. In private? Probably not worth the effort, just skip the cert warning.
    • nitrogen 6y ago
      Most hardware in this category really needs to be set-and-forget, whether online or not. You can't have every random sound system and light controller having to dial out to a third party every month. You need to be able to come back five years later and still be able to configure the hardware.
  • rad_gruchalski 6y ago
    Really. This: https://jamielinux.com/docs/openssl-certificate-authority/ https://jamielinux.com/docs/openssl-certificate-authority/ gives you a CA in about an hour. HashiCorp Vault will give you a CA in 5 minutes. certstrap will give you a CA in 15 seconds. It’s 2020, it ain’t voodoo anymore.
    • Karunamon 6y ago
      Just spinning up a CA is a couple of commands. Running one sanely (to include security of the private keys, availability and auditability of the signing machine, keeping backups, publishing a CRL, setting up ACME if you want any kind of automation) is significantly more involved.
      • Spivak 6y ago
        But this is silly. If this isn’t completely trivial to add to your app then something has gone horribly wrong. * Every machine in your infra already has backups, right? Nothing about your signing boxes are special in this regard. * All your services are already HA, right? The API servers that now have to run some glorified OpenSSL commands aren’t any different than your normal API endpoints. * You already have to protect secrets on your machines. DB passwords, API keys. What’s one more? * You don’t have to implement ACME. These are your devices talking to your devices.
      • rad_gruchalski 6y ago
        Nothing different than any long lived component in any infrastructure. There is no reason to look for reasons not to use a CA.