1 |
On Tuesday, June 1, 2021 12:44:47 PM CEST karl@××××××××.se wrote: |
2 |
> BillK: |
3 |
> ... |
4 |
> |
5 |
> > And another "wondering" - all the warnings about trusting self signed |
6 |
> > certs seem a bit self serving. Yes, they are trying to certify who you |
7 |
> > are, but at the expense of probably allowing access to your |
8 |
> > communications by "authorised parties" (such as commercial entities |
9 |
> > purchasing access for MITM access - e.g. certain router/firewall |
10 |
> > companies doing deep inspection of SSL via resigning or owning both end |
11 |
> > points). If its only your own communications and not with a third, |
12 |
> > commercial party self signed seems a lot more secure. |
13 |
> |
14 |
> ... |
15 |
> |
16 |
> You can use https://letsencrypt.org/ instead of a self-signed cert: |
17 |
> |
18 |
> Let's Encrypt is a free, automated, and open certificate authority |
19 |
> brought to you by the nonprofit Internet Security Research Group (ISRG). |
20 |
> |
21 |
> It was pretty simple to get it to work with |
22 |
> https://github.com/diafygi/acme-tiny |
23 |
|
24 |
It's not that easy to do it with internal-only systems as Let's Encrypt |
25 |
requires the hostname to be known externally. |
26 |
And there are plenty of devices you do not want the whole internet to know |
27 |
about. |
28 |
|
29 |
-- |
30 |
Joost |