You now have to build and self-shot a complete CA/PKI. Or request a certificate ...

mox1 · 2025-04-15T15:59:41 1744732781

Companies have software to manage this for you. We utilize https://www.cyberark.com/products/machine-identity-security/

stackskipton · 2025-04-15T15:57:06 1744732626

You could always ask for wildcard for internal subdomain and use that instead so you will leak your internal FQDN but not individual hosts.

pixl97 · 2025-04-15T17:36:59 1744738619

I'm pretty sure every bank will auto fail wildcard certs these days, at least the ones I've worked with.

Key loss on one of those is like a takeover of an entire chunk of hostnames. Really opens you up.

JoshTriplett · 2025-04-16T17:08:06 1744823286

> Or request a certificate over the public internet, for an internal service. Your hostname must be exposed to the web and will be publicly visible in transparency reports.

That doesn't seem like the end of the world. It means you shouldn't have `secret-plans-for-world-takeover.example.com`, but it's already the case that secret projects should use opaque codenames. Most internal ___domain names would not actually leak any information of value.