Re:Let's Encrypt root certificate trusted by Mozilla
by tracker1 on Friday August 05, 2016 @06:45PM
(#12236193)
Why not terminate public TLS/SSL at the proxy level, then use internal PKI for proxy to backing servers... It's be easy enough to have a single ACME server that handles all acme requests forwarded from the firewall(s), then federate that configuration out as needed.
[ Parent
| on HN ]
Re:Let's Encrypt root certificate trusted by Mozilla
by geofft on Friday August 05, 2016 @10:14PM
(#12236728)
The configs I was describing in my first paragraph don't involve proxies. Adding proxies doesn't really solve the problems, and even if it did, writing an in-house ACME server is a lot more work than "run this magic command".
The config I'm describing in my second paragraph is for internal web services within a corporate network, that aren't public-internet-facing at all. I don't want to have all my clients (including people's phones) add an internal PKI because that's just bad security practice.