Do I need an SSL Certificate anymore?

[CHiLL]

We've bought our wildcard SSL certificate from GoDaddy for many years now and they've auto-renewed two months early, at well over double the rate and charged the school credit card that was stored on the account (and actually overdrawn it causing other issues). This has got us thinking; do we actually need an SSL certificate anymore?

 

We used the *.school.bham.sch.uk certificate for the following services according to our documentation and internal knowledge:

• RDS - Now retired
  
• Microsoft Always-On VPN - Now Retired
  
• Home Access Plus - Now retired from external access - access is only internal only for the booking system
  

 

Our remote access method now is Sophos IPSec VPN, which doesn't use our school wildcard SSL certificate (as far as I am aware). I don't think we use the SSL certificate for anything else.

 

As I wrote the above, I realised that our internal Home Access access would start showing no/invalid certificate warnings when a user attempts to access either https://hap.school.bham.sch.uk or https://hap.school.local. Can I use our internal CA to generate trusted SSL certificates for internal websites?

[dmj]

As I wrote the above, I realised that our internal Home Access access would start showing no/invalid certificate warnings when a user attempts to access either https://hap.school.bham.sch.uk or https://hap.school.local. Can I use our internal CA to generate trusted SSL certificates for internal websites?

 

Yes if you are able to deploy them to *all* devices, and never use them externally.

IMO you would be better off using an ACME service and just use a real DV certificate, it doesn't cost anything and is just as easy to setup as an internal cert.

Unless you're a high end bank or something EV is overated these days IMO.

[ibpalle]

Hi CHill

 

You can use an internal self-signed/created CA to create certificates for internal infrastructure - external too if the only users accessing the resource are likely to have a trust for your Self-signed CA.

 

Since I use the Smoothwall HTTPS inspection, all my devices have the Smoothwall CA installed so I can create certificates for media server and other internal systems.

[k-strider]

answer is probably not needed anymore.

we dont have any external services now either so ive not bought one in a long time and lets face it if you are running a website or the likes most can work with letsencrypt.

Yes you can use your internal CA for internal sites with internal names and domain joined devices will trust them, and push it to managed devices via MDM like you do with your filtering certificate for other stuff like iPads.

you need to make the template in the CA avalible i then run the cert MMC as computer a couple of screenshots to help with making them valid so browsers trust them (Papercut we do this for)

 

i also have a doc for changing them to PEM for Linux using openssl if you need help with that.

[pete]

You can also use Let's Encrypt for internal sites provided you're not using a .local or a .internal.

 

We do if we know awkward devices may need to access them.

[mavhc]

You can create wildcards certs with LetsEncrypt using DNS. I moved my DNS to Cloudflare which supports it for free

[dhicks]

do we actually need an SSL certificate anymore?

 

If you need a secure internal website, both in the sense of having a valid SSL certificate and with authentication, I've found both Cloudflare's Zero Trust and ngrok's tunnel-with-authentication to work very well. Both offer (very) easy OAuth2 authentication, so you can host an internal website and limit the users to a subset of your Google / Microsoft / etc users. Limits apply for free acccounts - Cloudflare's free plan goes up to 50 monthly users, so suitible for smaller projects, ngrok gives you five free monthly users but pricing starts off a bit lower.

[jankipmehta]

Yes, you can use your internal CA to generate trusted SSL certificates for internal websites. This will allow users to access internal websites without encountering certificate warnings. However, it's important to ensure that your internal CA is properly configured and secured to prevent the issuance of fraudulent certificates.

 

Additionally, you may need to configure your devices to trust your internal CA's root certificate in order for the SSL certificates to be recognized as trusted.

[XiJ]

I’m using letsencrypt and cloud flare dns for my internal sites. I add cloudflare zero trust for the few external sites I have with outh. It was pretty easy to setup