4 ms·

I have a private CA for all internal hosts. It's a bit of a pain to run, but it's neccessary because "internal" includes VMs that run colocated servers and many

I have a private CA for all internal hosts. It's a bit of a pain to run, but it's neccessary because "internal" includes VMs that run colocated servers and many services to mutual authentication. It's hyper annoying that it's barely to not possible to include our own CA into mobile Browsers so that they can use internal websites. The alternative would be to depend on LE where neccessary, but this introduces an external dependency that I would rather avoid.

gjvnq 5y ago
Why not have your applications accessible through two URLs with yor CA and another with LetsEncrypt. Also, it may be possible to sign an SSL certificate with two authorities.
xoa 5y ago
>It's hyper annoying that it's barely to not possible to include our own CA into mobile Browsers so that they can use internal websites. You can? Any MDM should be able to deploy internal CAs, and at least on iPhones the free Apple Configurator 2 software will let you make profiles you can then easily deploy a bunch of ways. Doesn't scale easily but it's free and easy for small numbers. Also very useful period even for an individual or family to bootstrap devices and make changes if you've got significant numbers of email accounts for example. I'm sure Android has some equivalent.