2 ms·
The whole point of a local DNS and local CA though is to insulate yourself from cloud expenses and failures. Our DNS system has had 0 outages, whereas our Googl
by exabrial 3y ago
The whole point of a local DNS and local CA though is to insulate yourself from cloud expenses and failures. Our DNS system has had 0 outages, whereas our Google Fiber uplink has aprox one failure a month (Weather, construction, maintenance, upgrades, unscheduled outages).
It's just as easy to deploy a trusted CA using MDM as it is to deploy this.
- 8organicbits 3y agoThe split-dns setup [1] does a pretty good job of insulating users from cloud failures. Devices on your network use local DNS, no cloud needed. ACME clients start renewing certificates 30 days before expiration, and retry daily. The cloud API would need to be down 30 days in a row for the certificate renewal to fail. It's quite failure tolerant. If Let's Encrypt had an enormous outage, you could switch to ZeroSSL. Caddy actually fails over automatically [2]. Re. MDM, I've never seen a perfect rollout. [1] https://docs.getlocalcert.net/dns/split-view/ https://docs.getlocalcert.net/dns/split-view/ [2] https://caddyserver.com/docs/automatic-https#errors https://caddyserver.com/docs/automatic-https#errors