3 ms·
Bogus nonsense. Sign your internal certs with an internal CA, make your clients trust the CA. Use it properly.
by denkmoon 3mo ago
Bogus nonsense. Sign your internal certs with an internal CA, make your clients trust the CA. Use it properly.
- NicolaiS 3mo ago> "make your clients trust the CA" There's no single trust store: the OS has one, Firefox, Java (cacerts), Python (certifi), Node, Go containers, all your Docker images, ... Failure? People just toggle TLS verification off. Easy to do in a one-man shop, but almost impossible in any big company. Try grepping for verify=False / -k / InsecureSkipVerify in any fortune 500 and you'll find plenty
- denkmoon 3mo agoYes, it feels like I echo the same sentiment at work every few weeks. No, we can’t tick the PR with verify=false. Yes, you have to configure the trust store. Yes, it’ll take maybe an hour to work this out. Go do so please. The only reason is laziness.