Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TLS certificates for internal services done right

tuxnet.dev

Post reply on HN
Print view View original

171–177 of 177 posts

Re: TLS certificates for internal services done right

#171

Post by master_crab »

Walf wrote: post #170
master_crab wrote: post #169

Earlier quoted context omitted.

You don’t. You avoid split horizon because of the silent (usually failure) mechanics it introduces.

I wasn't talking about your opinion of it, I was simply using a rhetorical question to point out the nonsensical premise of your response: >Wait…what? You have a fully internal service and you dont have an internal DNS server? You can't do split horizon without an internal DNS service. By definition it's a non-public service that gives separate results to public.

Because I was responding to this comment you had made:

So what's your solution when you have a wholly private service that will never have a public v4 address, nor a publicly routable v6? How do clients get the address for a nice domain name without the addresses in public DNS?

Which, if you claim you use private DNS, you know you can indeed solve by only having the private records sit on your private DNS service that can only be hit by clients on the internal network. Without the architectural bad practice of implementing split horizon.

Re: TLS certificates for internal services done right

#172

Post by nijave »

aeden wrote: post #134
nijave wrote: post #83

Earlier quoted context omitted.

We have a few subdomains for white labeling 3rd party SaaS where we do what is basically the AWS ACM equivalent and add a persistent record from a vendor. With this setup, I don't have to grant 3rd parties DNS access. I actually made a webhook that allows per hostname API keys to wrap dnsimple because they only had per zone keys and I didn't want each VM to have access to the entire zone. These challenges would have…

Our current level of granularity allows you to give read or write access to a specific zone, but it does not go down to the level of giving read or write access to a specific RRset type yet, if that's what you're looking for.

Yeah, specific RRset

Re: TLS certificates for internal services done right

#173

Post by codymisc »

michaelt wrote: post #91
skywhopper wrote: post #61

Earlier quoted context omitted.

Is there a commonly used language other than Java that doesn’t just defer to the OS trusted CAs by default?

The behaviour of curl depends on how your version was built. Python? The widely used 'requests' relies on 'certifi' and skips the OS store - but 'pip' on the other hand does use the OS store. A tool that might use java, like a database or IDE, means it might have its own store. Node? Make sure you set NODE_USE_SYSTEM_CA=1 Firefox and Chrome AFAIK both have their own stores. Building a Docker container? That's intenti…

[flagged]

Re: TLS certificates for internal services done right

#174

Post by Walf »

master_crab wrote: post #171
Walf wrote: post #170

Earlier quoted context omitted.

I wasn't talking about your opinion of it, I was simply using a rhetorical question to point out the nonsensical premise of your response: >Wait…what? You have a fully internal service and you dont have an internal DNS server? You can't do split horizon without an internal DNS service. By definition it's a non-public service that gives separate results to public.

Because I was responding to this comment you had made: So what's your solution when you have a wholly private service that will never have a public v4 address, nor a publicly routable v6? How do clients get the address for a nice domain name without the addresses in public DNS? Which, if you claim you use private DNS, you know you can indeed solve by only having the private records sit on your private DNS service tha…

Mate, what on Earth are you talking about? A private DNS server that can only be hit by clients on an internal network, which differs from public DNS, is split horizon.

Re: TLS certificates for internal services done right

#175

Post by master_crab »

Walf wrote: post #174
master_crab wrote: post #171

Earlier quoted context omitted.

Because I was responding to this comment you had made: So what's your solution when you have a wholly private service that will never have a public v4 address, nor a publicly routable v6? How do clients get the address for a nice domain name without the addresses in public DNS? Which, if you claim you use private DNS, you know you can indeed solve by only having the private records sit on your private DNS service tha…

Mate, what on Earth are you talking about? A private DNS server that can only be hit by clients on an internal network, which differs from public DNS, is split horizon.

Bless your sweet heart if you think private DNS servers are split horizon. :)

Re: TLS certificates for internal services done right

#176

Post by Walf »

master_crab wrote: post #175
Walf wrote: post #174

Earlier quoted context omitted.

Mate, what on Earth are you talking about? A private DNS server that can only be hit by clients on an internal network, which differs from public DNS, is split horizon.

Bless your sweet heart if you think private DNS servers are split horizon. :)

Is there some reason you're being a patronising prick? Or do you really not know the definition of spilt horizon?

https://en.wikipedia.org/wiki/Split-horizon_DNS

I could not have been clearer that the private DNS servers I use provide different results from public, for the same names, which is the split. Not all private DNS servers are split horizon, and nothing I wrote implies that that's my understanding. If that's what you've concluded, then you've either failed to comprehend what I've written, or you're a troll.

Re: TLS certificates for internal services done right

#177

Post by master_crab »

Walf wrote: post #176
master_crab wrote: post #175

Earlier quoted context omitted.

Bless your sweet heart if you think private DNS servers are split horizon. :)

Is there some reason you're being a patronising prick? Or do you really not know the definition of spilt horizon? https://en.wikipedia.org/wiki/Split-horizon_DNS I could not have been clearer that the private DNS servers I use provide different results from public, for the same names, which is the split. Not all private DNS servers are split horizon, and nothing I wrote implies that that's my understanding. If that's…

Apologies. Not trying to come across as a prick.

But at least we both agree private dns =/= split brain. :)

Post reply on HN