3 ms·

I am confused. Isn't that easily automated?

• souprock 6y ago
  It's not easily automated. Somehow, you have to safely get a certificate across the air gap to the internal network. So I guess an internet-connected system grabs the certificates, then they get burned to DVD-R, then... a robot moves the DVD-R to the internal network? It's not easy. It's all much worse if the networks aren't physically adjacent. One could be behind a bunch of armed guards and interlocking doors.
  • sarakayakomzin 6y ago
    >you have to safely get a certificate across the air gap to the internal network. you can't trust a server on the internal network as root certificate trust? sounds like a scary situation.
  • skissane 6y ago
    An airgapped network can include its own internal CA, and all the airgapped clients can have that internal CA's certificate injected into their trust stores, and all the services on the airgapped network can automatically request certificates from the internal CA – which can even be done using the same protocol which Let's Encrypt uses, ACME, just running it over a private airgapped network instead of over the public Internet.
• mrweasel 6y ago
  We have a ton of internal stuff, most of it doesn’t even have external DNS. We use long lived certs signed with our own CA. we’d prefer using and automated solution, using a “real” CA, but non seems to be available.