3 ms·
100%! TLS is fragile, and working around it is often necessary. Certs can expire or be revoked (anywhere in the chain) and the renewal process can be bugged.
by anonymousiam 1y ago
100%!
TLS is fragile, and working around it is often necessary. Certs can expire or be revoked (anywhere in the chain) and the renewal process can be bugged. The time on the client (required for confirmation of certificate validity window) could be wrong (either accidentally or deliberately).
Requiring TLS on an inter-LAN connection is mostly useless, and impossible if no Internet gateway is available.
- sgjohnson 1y ago> Requiring TLS on an inter-LAN connection is mostly useless, and impossible if no Internet gateway is available. what do you mean? > Requiring TLS on an inter-LAN connection is mostly useless there are many ways to intercept inter-LAN traffic, and: > and impossible if no Internet gateway is available. DNS validation? Run your own CA and trust it in your intranet?
- anonymousiam 1y ago1: If no gateway to the WAN exists, the certificate chain cannot be validated. 2: I did say "mostly" useless. If your LAN is at risk of spoofing or MITM, then TLS probably will not solve all of your problems anyway. 3: Obviously you can create a local cert and add it to your trust chain. You'll still have problems with various embedded devices that don't have a RTC.