Possibly linux@lemmy.zip to Sysadmin@lemmy.worldEnglish · 1 year agoYou have a organizational identity right?lemmy.zipimagemessage-square35fedilinkarrow-up1330arrow-down123
arrow-up1307arrow-down1imageYou have a organizational identity right?lemmy.zipPossibly linux@lemmy.zip to Sysadmin@lemmy.worldEnglish · 1 year agomessage-square35fedilink
minus-squareJWBananas@startrek.websitelinkfedilinkEnglisharrow-up19arrow-down1·1 year agoAre you conflating self-signed and untrusted? Self-signed is fine if you have a trusted root deployed across your environment.
minus-squarenickwitha_k (he/him)@lemmy.sdf.orglinkfedilinkarrow-up6arrow-down2·1 year agoCorrect. If using actual pki with a trusted root and private CA, you’re just fine. I took the statement to mean ad-hoc self-signed certs, signed by the server that they are deployed on. That works for EiT but defeats any MitM protection, etc.
Are you conflating self-signed and untrusted?
Self-signed is fine if you have a trusted root deployed across your environment.
Correct. If using actual pki with a trusted root and private CA, you’re just fine.
I took the statement to mean ad-hoc self-signed certs, signed by the server that they are deployed on. That works for EiT but defeats any MitM protection, etc.