News for hackers. Stuff that matters.

A comment on Chromium and Mozilla to enforce 1 year validity for TLS certificates. Parent comment

Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by dingaling on Sunday June 28, 2020 @03:52PM (#23671545)
Giving an Internet-connected program autonomous write-access to system-critical filesystems is not considered good practice in production environments.

Much better to have a separate central cert management system that handles renewals and pushes the certs outwards to the DMZ systems.

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by AlfeG on Sunday June 28, 2020 @03:54PM (#23671559)
This is true for enterprise, but for small business Caddy or Traefik is totally fine.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by mholt on Sunday June 28, 2020 @04:26PM (#23671770)
Caddy is good for enterprise use too because of its configurable, pluggable storage backends (doesn't have to be a file system). You can achieve the permission segmenting your company requires.

You can also use it as a certificate manager independently of a web server if you want.

[ Parent | on HN ]