Re:I looked through attacks in my access logs
by baobun on Sunday January 28, 2024 @05:24PM
(#39170428)
You'd usually put a reverse proxy exposing the services and terminating TLS with the wildcard cert.
The individual services can still have individual non-wildcard internal-only certs signed by an internal CA. These don't need to touch an external CA or appear in CT logs - only the reverse proxy/proxies should ever hit these, and can be configured to trust the internal CA (only) explicitly.
The individual services can still have individual non-wildcard internal-only certs signed by an internal CA. These don't need to touch an external CA or appear in CT logs - only the reverse proxy/proxies should ever hit these, and can be configured to trust the internal CA (only) explicitly.