503
ICANN approves use of .internal domain for your network (www.theregister.com)
submitted 2 years ago by to c/selfhosted@lemmy.world
147 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[+] -9 points 2 years ago (3 children)

That sounds like a bad idea, you would need your CA and your root certs to be completely air gapped for it to be even remotely safe.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 10 points 2 years ago (1 child)

    Why?

    That’s a rather absolutist claim when you don’t know the orgs threat model.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] -3 points 2 years ago (2 children)

    For self hosting at least, having your own CA is a pain in the ass to make sure everything is safe and that nobody except you has access to your CA root key.
    I'm not saying it's not doable, but it's definitely a lot of work and potentially a big security risk if you're not 100% certain of what you're doing.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 2 years ago (1 child)

    Just use only VPN to access your services behind the reverse proxy, if you want prevent unauthorised connections.

    CA certificates are not here to prevent someone accessing a site, they are here, so that you can be sure, that the server you are talking to is really the one belonging to the domain you entered and to establish a tunnel in order to send the API calls (html, css, javascript etc.) and answers encrypted.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago (1 child)

    That's the problem, if anyone somehow gets your root CA key, your encryption is pretty much gone and they can sign whatever they want with your CA.
    It's a lot of work to make sure it's safe in a home setup.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 6 points 2 years ago (1 child)

    You can just issue new certificates one per year, and otherwise keep your personal root CA encrypted. If someone is into your system to the point they can get the key as you use it, there are bigger things to worry about than them impersonating your own services to you.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 2 years ago (2 children)

    What if I told you, businesses routinely do this to their own machines in order to make a deliberate MitM attack to log what their employees do?

    In this case, it'd be a really targetted attack to break into their locally hosted server, to steal the CA key, and also install a forced VPN/reroute in order to service up MitM attacks or similar. And to what end? Maybe if you're a billionaire, I'd suggest not doing this. Otherwise, I'd wonder why you'd (as in the average user) be the target of someone that would need to spend a lot of time and money doing the reconnaissance needed to break in to do anything bad.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 2 years ago* (1 child)

    Ah, you mean they put the cert in a transparent proxy which logs all traffic? Neat idea, I should try it at home

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago

    They (the service that provides both web protection and logging) installs their own root certificate. Then creates certs for sites on demand, and it will route web traffic through their own proxy, yes.

    It's why I don't do anything personal at all on the work laptop. I know they have logs of everything everyone does.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 0 points 2 years ago (1 child)

    I'm talking about home hosting and private keys. Not businesses with people whose full time job is to make sure everything runs fine.
    I'm a nobody and I regularly have people/bots testing my router. I'm not monitoring my whole setup yet and if someone gets in I would probably not notice until it's too late.
    So hosting my own CA is a hassle and a security risk I'm not willing to put work into.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago (1 child)

    As opposed to what, the domain certificate? Which can't be air-gapped because it needs to be used by services and reverse proxies.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago

    The domain certificate is public and its key is private? That's basically it, if anyone gets access to your key, they can sign with your name and generate certificates without your knowledge. That's my opinion and the main reason why I wouldn't have a self hosted CA, maybe I'm wrong or misled, but it's a lot of work to ensure everything is safe, only for a self hosted setup.

  • permalink
  • fedilink
  • source
  • parent