3 ms·
Let me put it this way; You might get away with installing your RootCA on your in-office PCs that you own. Good luck though getting me to install it on my (ex
by bruce511 3y ago
Let me put it this way;
You might get away with installing your RootCA on your in-office PCs that you own.
Good luck though getting me to install it on my (external contractor) laptop or my (employee) phone, or my (hosted) VMS machines. -you- may plan to only use the CA for good, but I don't trust you (and by extension all your IT staff, present, past, and future) to be angels.
- 8organicbits 3y agoExactly. It's one of the reasons I use separate VMs per client when I freelance. I want to install the cert, so I don't see the cert warning messages or accidentally click through a real MITM attack, but never on the host OS. That could let the client MITM all sorts of stuff like my email to other clients if Thunderbird syncs at a client site.
- skrebbel 3y agoKinda nuts actually that you can’t install a Root CA and tell the OS “but only ever use it for these and these domains”. That would solve this elegantly.
- bruce511 3y agoEven If you could tell the OS it would fail cause much (most?) software has an OS independent path to validate the certificate. OpenSSL for example uses a custom pem file that the program developer supplies.