Local website purchase SSL or self signed?
-
I have a local IIS server that we have taken off the internet permanently. Up to this point I've purchased a cert from GoDaddy for simplicity.
Now that this server will be kept only for internal use I have a few options.
I could move it to HTTP and not worry about the SSL
Renew the SSL with GoDaddy
install locally signed cert.I'm not keen on getting rid of the SSL. It's medical data, and even though it will only be on the local network, I still don't like the idea of it not being encrypted on the line.
Renewing is fine - cost is not a big enough factor to make me not do it.
Using a locally signed cert would require me to either
a) listen to users whine because of the cert error or
b ) push the root cert out to all of my end users to make them trust the local cert.Pros and Cons guys and gals?
-
We do self signed because.... users need to shut up.
-
@scottalanmiller said:
We do self signed because.... users need to shut up.
ROFLOL
damn bro.. Gotta love it!!!!!
-
You should be able to get one from StartCom (https://cert.startcom.org/) If you don't need any thing fancy it should work fine.
-
This is a situation where Let's Encrypt would be all that I need.
-
Yeah users need to shut it...
You're in the corporate network, which is heavily monitor'd.
So as Scott said, they need to shut it.
-
@Dashrender said:
This is a situation where Let's Encrypt would be all that I need.
Have they started issuing certificates yet?
-
@dafyre said:
@Dashrender said:
This is a situation where Let's Encrypt would be all that I need.
Have they started issuing certificates yet?
They are in a Beta stage now.
-
and they don't currently have a Windows client.. yeah!
-
@DustinB3403 said:
Yeah users need to shut it...
You're in the corporate network, which is heavily monitor'd.
So as Scott said, they need to shut it.
I completely disagree with this. I do not want users to have to ever get used to clicking through an error screen. Doing so on an internal site means instructing them to do so whenever they see it. Do you honestly expect general users to have the level of knowledge to properly read the error and confirm the internal URL?
-
Awesome, that's the kind of thing I was looking for.
With NTG I can totally understand this.. they are all technical people.. but here, they are all the technical Luddites.
-
@JaredBusch said:
@DustinB3403 said:
Yeah users need to shut it...
You're in the corporate network, which is heavily monitor'd.
So as Scott said, they need to shut it.
I completely disagree with this. I do not want users to have to ever get used to clicking through an error screen. Doing so on an internal site means instructing them to do so whenever they see it. Do you honestly expect general users to have the level of knowledge to properly read the error and confirm the internal URL?
That's an excellent point. I often forget that one but it does matter a lot in most cases.
-
@Dashrender said:
Awesome, that's the kind of thing I was looking for.
With NTG I can totally understand this.. they are all technical people.. but here, they are all the technical Luddites.
Right, that's why we often go that route internally.
-
As @JaredBusch said.
Why would you ever tell users to ignore such a fundamental error message? If they get that error when logging into say, Office 365, do you want them typing in their credentials to a bogus website?
-
@JaredBusch said:
@DustinB3403 said:
Yeah users need to shut it...
You're in the corporate network, which is heavily monitor'd.
So as Scott said, they need to shut it.
I completely disagree with this. I do not want users to have to ever get used to clicking through an error screen. Doing so on an internal site means instructing them to do so whenever they see it. Do you honestly expect general users to have the level of knowledge to properly read the error and confirm the internal URL?
Exactly. That's promoting bad habits. We use self-signed ones in places however push the Certs out as trusted via GPOs fixes any errors in browsers.
-
@DustinB3403 said:
You're in the corporate network, which is heavily monitor'd.
Heavily monitored doesn't mean protected from stupid actions, which is how most things get in. You can't rely on a single point to protect you from vulnerabilities. You need good user training in addition to AV and network firewalls. User training is the most important.
-
If you just need the SSL, StartSSL offers free certs. You don't have the insurance of a paid cert, but it's still encrypted and it's still green.
-
@Jason said:
You need good user training in addition to AV and network firewalls. User training is the most important.
User training..... hahaha....
So as with anything lets perform a math exercise and calculate the continuing cost of effectively training users, versus the cost of build a good security policy with backup and recovery functionality (not excluding cost to upgrade it and maintain it)
-
@DustinB3403 said:
@Jason said:
You need good user training in addition to AV and network firewalls. User training is the most important.
User training..... hahaha....
So as with anything lets perform a math exercise and calculate the continuing cost of effectively training users, versus the cost of build a good security policy with backup and recovery functionality (not excluding cost to upgrade it and maintain it)
Don't forget to add the cost of a breach.
Reputation
Fines -
@Breffni-Potter said:
Don't forget to add the cost of a breach.
Reputation
FinesLoss of stock value, investors etc.
