4 ms·

If you have admin/root, it's usually easier to just add the leaf cert to the CA trust store.

by nijave 3y ago

gerdesj 3y ago
I do but do you have any idea how many of the bloody things I have to add? I have lots of customers with VMware - the vCentres each have a CA. ... all their switches, routers, other stuff ... a lot of stuff. Each one is secure, or at least I decide if it is - I know where it is and I keep its firmware up to date. I communicate with each device over https and I know all is good. Where this nonsense goes wrong is that a browser programmer thinks that they know better than me and impose their policy on me, with no recourse. My tenon saw does not tell me how to use it. If I bark my knuckles or cut off my fingers that is my fault. My browser (maintained by fucking children) thinks it knows best for me. I suggest that the cool kids have a major rethink about who knows what's best in quite a few scenarios that they never even considered and basically grow up. That's what I had to do, back in the day and is pretty much what all adults will eventually confess to because that is what growing up means.
- midasuni 3y ago
  That’s sort of stuff sits on an isolated vlan. My proxy (with a decent trusted very) talks to them, either via http or self signed https. Proxy also handles the authentication (via oidc or x509) and logging.
briHass 3y ago
I do that at home, but you still have annoyances, like Android forever warning you that you're impure because your cert hasn't been kissed by a real CA. Also, some random things are a real PITA to put your signed cert on, like Ubiquiti Unifi, where you have to mess around with the Java keystore. I wouldn't bother with any of it if it wasn't for Crome thinking I shouldn't save passwords for HTTP, even though they could clearly make an exception for domain names that resolve to private IP blocks.

4 ms·

If you have admin/root, it's usually easier to just add the leaf cert to the CA trust store.

by nijave 3y ago

If you have admin/root, it's usually easier to just add the leaf cert to the CA trust store.

gerdesj 3y ago
I do but do you have any idea how many of the bloody things I have to add? I have lots of customers with VMware - the vCentres each have a CA. ... all their switches, routers, other stuff ... a lot of stuff. Each one is secure, or at least I decide if it is - I know where it is and I keep its firmware up to date. I communicate with each device over https and I know all is good. Where this nonsense goes wrong is that a browser programmer thinks that they know better than me and impose their policy on me, with no recourse. My tenon saw does not tell me how to use it. If I bark my knuckles or cut off my fingers that is my fault. My browser (maintained by fucking children) thinks it knows best for me. I suggest that the cool kids have a major rethink about who knows what's best in quite a few scenarios that they never even considered and basically grow up. That's what I had to do, back in the day and is pretty much what all adults will eventually confess to because that is what growing up means.
- midasuni 3y ago
  That’s sort of stuff sits on an isolated vlan. My proxy (with a decent trusted very) talks to them, either via http or self signed https. Proxy also handles the authentication (via oidc or x509) and logging.
briHass 3y ago
I do that at home, but you still have annoyances, like Android forever warning you that you're impure because your cert hasn't been kissed by a real CA. Also, some random things are a real PITA to put your signed cert on, like Ubiquiti Unifi, where you have to mess around with the Java keystore. I wouldn't bother with any of it if it wasn't for Crome thinking I shouldn't save passwords for HTTP, even though they could clearly make an exception for domain names that resolve to private IP blocks.