3 ms·

> somebody compromising printer.lan.example.com can impersonate auth.lan.example.com Nope: one can setup ACLs so that the script that can update the records fo

• Arch-TK 3y ago
  If someone is on your network, you have to start worrying about traffic spoofing, unless you've got a seriously locked down switch (I do). But even so. Poor security practice to use a wildcard. I completely agree there. But I can understand how wildcard certs work well for the average Joe who just wants internal stuff to be served over TLS without having to think about it too hard. I work in security, so in my view, having the most secure internal network possible (think ZTA) is certainly up there. Although I have come up with an alternative approach to achieve this.