• jemikwa@lemmy.blahaj.zone
    link
    fedilink
    English
    arrow-up
    19
    ·
    edit-2
    1 year ago

    From an IT perspective with little context on this change other than what’s in the article, if there’s no way to import your own certs using an MDM, this change is terrible for businesses.

    You need custom certs for all kinds of things. A company’s test servers often don’t use public CA certs because it’s expensive (or the devs are too lazy to set up Let’s Encrypt). So you import a central private CA cert to IT-managed devices so browsers and endpoints don’t have a fit.

    For increased network security, private CAs are used for SSL decryption to determine what sites devices are going to and to check for malware embedded in pages. In order to conduct SSL decryption, you need your own private CA cert for decrypting and re-encrypting web content. While this is on the decline because of pinned certs being adopted by big websites, it’s still in use for any sites you can get away with. You basically kill any network-level security tools that are almost certainly enabled on the VPN/SASE used to access private test sites.

    • alr@programming.dev
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      Re: too lazy for Let’s Encrypt, a) last I used LE (for my personal site), your site had to be publicly available on the Internet so that you could prove you controlled the site. Most test servers are not public. and b) many (most?) companies would throw a fit if you started generating your own certificates for their domains.

      But there are always solutions. I was able to talk my company into getting properly signed certs for our test servers.