> why can't I just make the two talk without going through the public internet, or adding a self-signed CA to a bunch of trust stores? Sure you can. Getting a

> why can't I just make the two talk without going through the public internet, or adding a self-signed CA to a bunch of trust stores? Sure you can. Getting a valid, trusted certificate from a public entity doesn't mean that your service has to be public. Just get one and assign private IPs to the domain. I get the idea of not doing that if you want to be a purist about the isolated approach. But then you should be ready to implement something that others don't care about as much as you do.