2 ms·
>> (e.g. anything where the servers are not connected to the Internet and do not even have every-few-days Internet access It is possible to add your own root c
by bruce511 3y ago
>> (e.g. anything where the servers are not connected to the Internet and do not even have every-few-days Internet access
It is possible to add your own root certificate to clients on the LAN. so the equivalent of hand-distributed keys. Granted, this leads to unwelcome other problems (you can't limit your root to your local domain) so it's not often done, but it is possible.
Personally I prefer the DNS-challenge approach I described in a sibling comment.
- amluto 3y ago> you can't limit your root to your local domain This limitation in browsers is IMO an utter embarrassment.
- jcranmer 3y ago> you can't limit your root to your local domain Isn't this possible with NameConstraints?
- bruce511 3y agoThanks for the tip. I've not come across this before so will investigate further. Thus isn't the only issue with distributing your own root, but it is a significant one. Thanks again.
- toast0 3y agoNameConstraints used to break in Safari: if you didn't set them mandatory, the constraints would be ignored and you could sign anything; if you set them mandatory, the certificate wouldn't validate. But it looks like support was added in 10.13.3, circa 2018, so probably good to go. Might break some things, and I'm not aware of any mainstream uses, but obviously it'd be really handy if it's usable.
- X-Istence 3y agoMy place of work uses it extensively with Chrome/Firefox/Safari without issues. It's great.
- cvalka 3y agoIt is. It is required in some countries (RU, CN).