Re:The modern HTTPS world has no place for old web servers
by ccmcarey on Wednesday May 13, 2020 @06:21AM
(#23165382)
As its internal, you'll need to look into setting up a PKI. You'll need to create a certificate authority that has its public cert installed on every host accessing the internal site, and then you use that CA to sign the certificate for the internal site.
[ Parent
| on HN ]
Re:The modern HTTPS world has no place for old web servers
by shrikant on Wednesday May 13, 2020 @07:02AM
(#23165636)
This sounds like it could work. Since it's a workplace server and is only accessed internally by workplace-issued machines (which are always on the workplace VPN), I think there might be some sort of public cert already in place. Guess I just have to hunt down a certificate!
Re:The modern HTTPS world has no place for old web servers
by JoshTriplett on Wednesday May 13, 2020 @01:05PM
(#23169036)
It's still preferable to use a real DNS name and a real certificate, if you possibly can, which means that nobody has to install a CA.
There's currently no way on any modern system, as far as I'm aware, to install a CA but limit it to only a specific domain and its subdomains; any CA you install can issue a certificate for any domain. (There are theoretically some certificate extensions that allow limiting a certificate to subdomains, but as far as I can tell, implementations don't reliably support those extensions.)