Chrome’s address bar will use https:// by default

Re:Chrome’s address bar will use https:// by default by Spivak on Tuesday March 23, 2021 @03:15PM (#26559104)

I don't think Let's Encrypt is going to be the right use-case for you then. I think your best bet is to work with another CA to get your company an intermediate cert that you can use to issue longer certs that include ip addresses in the SAN.

Then it's just a matter of the devices connecting to the internet at least once a year and doing a very simple "Hey, I'm $device and using $address. Issue me a cert plz."

[ Parent | on HN ]

Re:Chrome’s address bar will use https:// by default by xg15 on Tuesday March 23, 2021 @05:08PM (#26560425)

> work with another CA to get your company an intermediate cert

I'm no expert, but wouldn't that make GP's company effectively a delegate CA? This seems like it would need a very close relationship with the original CA - and all just for a simple web interface.

> include ip addresses in the SAN.

Not sure if this may be different with intermediate certs, but you won't find any public CA that will add private IP addresses as a SAN - as this would undermine the whole security model. If any CA did this, Chrome would likely ban them quickly.

I'm sceptical a CA would let you do that with intermediate certs if there is any danger the leaf certs get into the wrong hands (e.g. because the devices are sold, someone reverse-engeneers one and manages to talk to the back-end service)

[ Parent | on HN ]