3 ms·
It does have some advantages in that you don't have key material on every single server. How much this risk actually matters will vary. I suspect most enterpris
by sweetjuly 3y ago
It does have some advantages in that you don't have key material on every single server. How much this risk actually matters will vary. I suspect most enterprises would actually be relatively safe with their frontend certificates being compromised, though the same cannot be said about the actual compromise of the backend application.
- pclmulqdq 3y agoI assume you would either use self-signed certs or run a private CA to do this. You wouldn't get the attestation benefits, but there's no material of any value in each container if you do this. The encryption is the only benefit. Reading that comment, I sort of understand why people don't do this because it takes some understanding of HTTPS and cryptography to do this properly.