Sysadmin

7467 readers

1 users here now

A community dedicated to the profession of IT Systems Administration

No generic Lemmy issue posts please! Posts about Lemmy belong in one of these communities:
[email protected]
[email protected]
[email protected]
[email protected]

founded 1 year ago

MODERATORS

[email protected]

308

You have a organizational identity right? (lemmy.zip)

submitted 10 months ago by [email protected] to c/[email protected]

35 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 29 points 10 months ago (3 children)

If it is for internal only, self signed is a lot easier.

[–] [email protected] 1 points 10 months ago

Also probably no sysadmin uses it, but the Gemini protocol requires the use of a self signed cert

[–] [email protected] -3 points 10 months ago (1 children)

Hard disagree. As long as you have any machine with internet access it’s trivial, even more so if you can use DNS challenge.

[–] [email protected] 3 points 10 months ago* (last edited 10 months ago)

You're absolutely correct. For self hosting at home I use cloudflare for DNS challenges.

Caddy is also amazing at making things even simpler.

[–] [email protected] -5 points 10 months ago (1 children)

So is using "pass" as the password to all of your sensitive systems. Still not best, or even good practice.

[–] [email protected] 18 points 10 months ago (1 children)

Are you conflating self-signed and untrusted?

Self-signed is fine if you have a trusted root deployed across your environment.

[–] [email protected] 4 points 10 months ago

Correct. If using actual pki with a trusted root and private CA, you're just fine.

I took the statement to mean ad-hoc self-signed certs, signed by the server that they are deployed on. That works for EiT but defeats any MitM protection, etc.