3 ms·

The server authentication story is fairly weak. Multiple companies may use the same .internal domain name and none of them can get a TLS certificate from a publ

The server authentication story is fairly weak. Multiple companies may use the same .internal domain name and none of them can get a TLS certificate from a public certificate authority. This means they'll each need to operate a private CA if they want to authenticate connections to the server (and encrypt with HTTPS). A major problem with this approach is that computers (especially laptops) travel between networks and can end up trusting more than one private CA. This means that you can have multiple servers using the same domain name, but operated by different orgs, and each appears valid to the end user. Session cookies and other data can leak when this happens. I think the right solution is that we should require domain registration (google.internal, microsoft.internal, etc.) to avoid these conflicts. A public CA may be able to verify ownership, avoiding the need for private CAs. I built a service [1] that does this and is compatible with Let's Encrypt. The trick is that I only allow users to set ACME-DNS01 TXT records, not A/AAAA/CNAME records. So you'll still need to run internal DNS for those. [1] https://www.getlocalcert.net/ https://www.getlocalcert.net/

crote 3y ago
What's the benefit over just buying a regular domain for my internal stuff? The result would be about the same, and I wouldn't be dependent on you never going out of business.
- 8organicbits 3y ago
  Even with a TLD, going out of business is a concern. Take Freenom as an example, they had rampant abuse and ran into funding issues. People who previously used that service for free internal domains have been looking for a new home. What's different is that the public suffixes I operate cannot publicly host content, which should protect the service from the abuse concerns that plagued Freenom and other free public suffixes. That reduces cost and should keep the site running. I recommend buying your own domain if you don't mind the cost. A free solution for domains with TLS on internal networks is valuable to many.

crote 3y ago

What's the benefit over just buying a regular domain for my internal stuff? The result would be about the same, and I wouldn't be dependent on you never going out of business.

8organicbits 3y ago
Even with a TLD, going out of business is a concern. Take Freenom as an example, they had rampant abuse and ran into funding issues. People who previously used that service for free internal domains have been looking for a new home. What's different is that the public suffixes I operate cannot publicly host content, which should protect the service from the abuse concerns that plagued Freenom and other free public suffixes. That reduces cost and should keep the site running. I recommend buying your own domain if you don't mind the cost. A free solution for domains with TLS on internal networks is valuable to many.