this post was submitted on 05 Sep 2023
262 points (98.2% liked)
Programming
16952 readers
426 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities !webdev@programming.dev
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
From an IT perspective with little context on this change other than what's in the article, if there's no way to import your own certs using an MDM, this change is terrible for businesses.
You need custom certs for all kinds of things. A company's test servers often don't use public CA certs because it's expensive (or the devs are too lazy to set up Let's Encrypt). So you import a central private CA cert to IT-managed devices so browsers and endpoints don't have a fit.
For increased network security, private CAs are used for SSL decryption to determine what sites devices are going to and to check for malware embedded in pages. In order to conduct SSL decryption, you need your own private CA cert for decrypting and re-encrypting web content. While this is on the decline because of pinned certs being adopted by big websites, it's still in use for any sites you can get away with. You basically kill any network-level security tools that are almost certainly enabled on the VPN/SASE used to access private test sites.
Re: too lazy for Let's Encrypt, a) last I used LE (for my personal site), your site had to be publicly available on the Internet so that you could prove you controlled the site. Most test servers are not public. and b) many (most?) companies would throw a fit if you started generating your own certificates for their domains.
But there are always solutions. I was able to talk my company into getting properly signed certs for our test servers.