• Fal@yiffit.net
    link
    fedilink
    English
    arrow-up
    7
    ·
    1 year ago

    you are unable to protect against MitM and other forgery attacks

    Uhh, using a self signed cert doesn’t mean you just accept any old cert… Not every cert is designed for serving content to a browser. You do SSL mutual auth between services using self signed certs

    • nickwitha_k (he/him)@lemmy.sdf.org
      link
      fedilink
      arrow-up
      1
      arrow-down
      2
      ·
      1 year ago

      You do SSL mutual auth between services using self signed certs

      If you do, you remove the ability to prove that a service is what it claims to be as this requires accepting its provided cert - that is, authenticate it. You have to trust somewhere, even in a “zero trust” environment. Using self-signed certs for services to communicate means that you have to either have manual involvement every time a service comes up or accept the authenticity of a self-signed cert automatically. Either would be a compromise in security over use of a private CA, not an improvement.

      Again, that works if your only concern is data across the pipes being encrypted during transmission but, it removes nearly all of the other additional security provided by PKI and increases your threat surface. It can be acceptable in some cases, like dev envs or as temporary measures but, with the constant increase in malicious traffic and activity, we’ve got to aim for better.

      • Fal@yiffit.net
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        Oh. I’m absolutely including a private CA as part of self signed cert. That’s probably my misuse of the term

        • nickwitha_k (he/him)@lemmy.sdf.org
          link
          fedilink
          arrow-up
          2
          ·
          1 year ago

          Oh! Then you are doing it right. That was basically my entire objection - having A chain of trust is necessary to effectively and securely use certs because you have a mechanism to validate, rather than trust the cert that is presented as authentic. :)