6 ms·
It's not easily automated. Somehow, you have to safely get a certificate across the air gap to the internal network. So I guess an internet-connected system gr
by souprock 6y ago
It's not easily automated. Somehow, you have to safely get a certificate across the air gap to the internal network.
So I guess an internet-connected system grabs the certificates, then they get burned to DVD-R, then... a robot moves the DVD-R to the internal network? It's not easy. It's all much worse if the networks aren't physically adjacent. One could be behind a bunch of armed guards and interlocking doors.
- sarakayakomzin 6y ago>you have to safely get a certificate across the air gap to the internal network. you can't trust a server on the internal network as root certificate trust? sounds like a scary situation.
- skissane 6y agoAn airgapped network can include its own internal CA, and all the airgapped clients can have that internal CA's certificate injected into their trust stores, and all the services on the airgapped network can automatically request certificates from the internal CA – which can even be done using the same protocol which Let's Encrypt uses, ACME, just running it over a private airgapped network instead of over the public Internet.