4 ms·
You now have to build and self-shot a complete CA/PKI. Or request a certificate over the public internet, for an internal service. Your hostname must be expose
by cryptonym 1y ago
You now have to build and self-shot a complete CA/PKI.
Or request a certificate over the public internet, for an internal service. Your hostname must be exposed to the web and will be publicly visible in transparency reports.
- stackskipton 1y agoYou could always ask for wildcard for internal subdomain and use that instead so you will leak your internal FQDN but not individual hosts.
- pixl97 1y agoI'm pretty sure every bank will auto fail wildcard certs these days, at least the ones I've worked with. Key loss on one of those is like a takeover of an entire chunk of hostnames. Really opens you up.
- mox1 1y agoCompanies have software to manage this for you. We utilize https://www.cyberark.com/products/machine-identity-security/ https://www.cyberark.com/products/machine-identity-security/
- JoshTriplett 1y ago> Or request a certificate over the public internet, for an internal service. Your hostname must be exposed to the web and will be publicly visible in transparency reports. That doesn't seem like the end of the world. It means you shouldn't have `secret-plans-for-world-takeover.example.com`, but it's already the case that secret projects should use opaque codenames. Most internal domain names would not actually leak any information of value.