2 ms·
I wish there was also some sufficiently long option in use cases where security is somewhat less critical and automatic renewal is much harder. This being devic
by Ekaros 2y ago
I wish there was also some sufficiently long option in use cases where security is somewhat less critical and automatic renewal is much harder. This being devices with web interfaces in local network. Which in some cases might not even have internet connectivity. Getting new cert every 45 days there is real headache...
For public internet yes, shorter is not entirely unreasonable.
- bravetraveler 2y agoAt that point, I feel self signed is entirely fine. Off the Internet, nobody outside of your control is trying to verify
- Ekaros 2y agoFor machine-to-machine sure. But once browsers start doing this and might even stop self-singed certs... Lot of outdated browsers will be around...
- bravetraveler 2y agoEh, even browsers. To my knowledge they still respect the OS trusts. Managing this is a standard part of any corporate deployment. Again, all of these devices are theoretically under your (intermittent) influence
- ndsipa_pomu 2y agoFor local services, you can get certificates with CAs that support DNS validation (e.g. LetsEncrypt support that). You'll likely want a DNS provider that has a suitable API so that the e.g. ACME script can post the relevant code to the DNS record, but then you're good to go. A proper public domain name that points at an internal only IP address. The other benefit of DNS validation is that you don't need to run it on the web server itself (e.g. if it doesn't have internet connectivity), but you can have an ordinary PC/laptop request the certificate and then copy it to where it's needed.