Re:.INTERNAL is now reserved for private-use applications
by Helmut10001 on Sunday August 11, 2024 @01:28AM
(#41214165)
This is also my thinking.. if someone compromises your VM that is responsible for retrieving wildcard certs from let's encrypt, then you're probably busted anyway. Such a machine would usually sit at the center of infrastructure, with limited need to be connected to from other machines.
[ Parent
| on HN ]
Re:.INTERNAL is now reserved for private-use applications
by brewmarche on Sunday August 11, 2024 @11:53AM
(#41217059)
Probably most people would deem the risk negligible, but it’s still worth to mention it, since you should evaluate for yourself. Regarding the central machine: the certificate must not only be generated or fetched (which as you said probably will happen “at the center”) but also deployed to the individual services. If you don’t use a central gateway terminating TLS early the certificate will live on many machines, not just “at the center.”
Re:.INTERNAL is now reserved for private-use applications
by Helmut10001 on Monday August 12, 2024 @10:41PM
(#41231672)
You are absolutely right. And deployment can be set up to open up additional vulnerabilities and holes. But there are also many ways to make the deployment quite robust (e.g. upload via push to a deploy server, distribute from there). ... and just by chance, I've written a small bash script that helps to distribute SSL certificates from a centrally managed "deploy" server 8) [1].