> add its certificate to your trust stores

If only that was so simple and all software used a common store... Without exceptions like java apps, apps with hardcoded ca_path, scripts which call curl with hardcoded ca_path, etc. On top of that are websockets in FF which will just fail rather than notify you about untrusted certificates. After experiencing that first-hand for a while, I wouldn't recommend this idea. It's the second greatest annoyance after enterprise web proxies.

> add its certificate to your trust stores

I wouldn't install a company CA certificate on my Mac. It would theoretically allow the company to intercept all my SSL connections. I'd rather validate SSL certs for all the intranet servers manually.

We're talking about server-to-server connectivity here.

Huh? The top level comment said something about Google search using SSL and "clicking through certificate warnings" which doesn't sound like server-to-server connectivity to me.

If you're worried about your employer performing man in the middle attacks to read your data, you might be working at the wrong company.

If you blindly trust anybody, you clearly don't value your privacy as much as I do.

> Self-signed certificates don't work at all on the public Internet, but they're just fine for internal resources, as long as you can somehow pin them.

Yes self-signed certificates don't work for web servers/browsers but they work great for *aaS providers.

A lot of DBaaS providers sign their server SSL certificates with an internal self-signed CA (ex: AWS for MySQL RDS[1]). You just need to retrieve the CA certificate over a secure channel (ex: HTTPS) and save it along with the rest of the DB config for your app (user/pass/host/port) so it's pinned.

This is arguably better than using the browser-CA chain as the service provider itself would need to be complicit in compromising it (vs a malicious trusted root issuing a fraudulent trusted cert for the remote server).

[1]: http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_M...

Just a nit: those aren't self-signed certificates; those are certificates signed by an internal CA. A self-signed certificate is a standalone entity.

You don't really mean self-signed, do you? I'm a doctor. Here's my diploma. I created and signed it myself. But trust me, I really am a doctor. I hope you really meant that you use an internal CA that issues certs and that you trust that CA instead.

I mean self-signed, if you pin the certs. I also mentioned internal CAs.

Self-signed certs work for internal infrastructure because you control the full chain of trust. One server issues the "diploma" and the other checks it, but they're both your servers, so the trust is predetermined.

Internal CA is more about expediency than anything else. It's just easier to manage trust between a lot of servers that way than by manually exchanging self-signed certs across all the permutations.