4 ms·
Not sure if internal services necessaruly require valid certificates. Most of them don't even require encryption. Both encryption, decryption, signing, and vali
by de6u99er 6y ago
Not sure if internal services necessaruly require valid certificates. Most of them don't even require encryption. Both encryption, decryption, signing, and validating signatures will only cost cpu-cycles and increase total power consumption.
Looking at what Epic is doing, I would encrypt customer data and everything that involves money. IMO only communication between data centers, with external payment providers, and with users must be encrypted and require valid certificates.
- the8472 6y agoModern CPUs come with instructions that make symmetric crypto very cheap. And if you err in the other direction you end up with "SSL added and removed here! :^)"
- Hamuko 6y agoI'm running Let's Encrypt certificates on services that are only accessible in my home network. And I live alone. I mean, why not? (Granted my certs actually failed earlier this week since my automation had broken)
- xtracto 6y agoOne problem with Let's Encrypt certs only work for public domains.
- MaxBarraclough 6y agoIs that really a problem though? Just create a dummy public-facing page.
- NovemberWhiskey 6y agoRight; technically the ACME protocol itself could be implemented on a private network, but honestly it has a whole mess of complexity because it's designed around the assumption that the requester and the issuer are arms-length counterparts.
- remram 6y agoYou can verify ownership of a domain via DNS [1], so you don't need the IPs in the A/AAAA records to be publicly accessible. Or be public IPs. Indeed you don't even need those A/AAAA records to be available from your DNS server from the internet. You do need a domain though. [1]: https://letsencrypt.org/docs/challenge-types/#dns-01-challenge https://letsencrypt.org/docs/challenge-types/#dns-01-challen...