1

Been meaning to do this for a long time however whats the best practice in order to get internal servers protected with SSL Certs? I think there are 3 real options?

  1. Self-signed Cert

  2. Set up my own CA

  3. Use public certs, but for internal addresses

Whats would you guys recommend?

9 Spice ups
2

Depends on how you want to go about it. Self-signed certs are going to enable SSL but throw trust errors and are relatively simple. It’s not much harder to get a publicly signed certificate that has an intermediate chain, if required, and would automatically be trusted. Setting up your own CA also accomplishes this but is the most time consuming.

If these servers are only ever going to be accessed internally by domain resources, I’d probably go for setting up my own CA.

3

Do you have funding for this project?
How much labour do you have available for this project?
Do you or your team members have PKI skills?
Are you a cloud-based shop or all on-prem?

Depending on how you answer these questions will guide you in the right direction.

Self-signed Cert:
I would not recommend this, it is hard to manage, and there is more room for human error.

Own CA:
There are free CA options, but then you have a learning curve, and you need to ensure that you maintain the CA which even if you use a free product, you take on additional labour cost.

Public CA:
There are some free option (e.g. LetsEncrypt), and there are paid options. It comes down to certificate management tools, infrastructure, root ubiquity (how trusted are their roots… even though this is internal it will impact the level of deployment depending on the age of your infrastructure), Vetting procedures, product and technical support.

If you decided on a paid certificate solution, you have industry experts and knowledge, SLA’s, warranty and reduce your labour cost.

let me know if you questions.

4

it’s fancy to do your own CA servers but in the long run, just go for number 3. saves a lot of headache.

5

It depends.

For testing and such like, self-signed certs work well.

For an internal application, set up an organisational; CA and go from there.

If the certs are going to to be used somehow externally go public CA.

What are your requirements?