If someone is on your network, you have to start worrying about traffic spoofing, unless you've got a seriously locked down switch (I do). But even so. Poor se

If someone is on your network, you have to start worrying about traffic spoofing, unless you've got a seriously locked down switch (I do). But even so. Poor security practice to use a wildcard. I completely agree there. But I can understand how wildcard certs work well for the average Joe who just wants internal stuff to be served over TLS without having to think about it too hard. I work in security, so in my view, having the most secure internal network possible (think ZTA) is certainly up there. Although I have come up with an alternative approach to achieve this.