News for hackers. Stuff that matters.

A comment on Should you use Let's Encrypt for internal hostnames?. Parent comment

Re:Should you use Let's Encrypt for internal hostnames? by infogulch on Wednesday January 05, 2022 @01:16PM (#29812771)
That's great to hear! I'd only heard secondhand, so I updated my comment to reflect this detail.

Also I found https://bettertls.com publishes details about which TLS features are supported on different platforms over time, and it appears that the latest test in Dec 2021 shows most platforms support name constraints.

With that roadblock evaporated, I think this would be the perfect solution to a lot of organization- and homelab-level certificate woes. I'd really like to hear from a domain expert on how feasible it would be to automate for free public certs, ACME-style.

[ Parent | on HN ]
Re:Should you use Let's Encrypt for internal hostnames? by wolrah on Wednesday January 05, 2022 @03:01PM (#29814149)
I'm happy to see that a big name like Netflix is getting behind this. I've been wishing for better Name Constraints support ever since learning how certificates work. Almost every situation where someone currently uses a wildcard could be done better with a name constrained CA cert.

I would love for this to become as widely supported as wildcards so those who choose to use them could do so easily.

[ Parent | on HN ]