Hacker News Reader

Sure, distribute your own root CA, but then how do people get signed certificates? I tend to work with large companies, where getting a signed certificate involves opening a ticket and waiting for someone on the other side to respond.

ACME would be ideal, but the official response of Let's Encrypt is that ACME is overkill for corporate environments and you should roll your own certificate automation.

View on HN

Delegating enroll permissions is a solved problem technically at least in a windows domain. At that point it's an org policy problem and ACME won't help.

In an enterprise, you use the API that a CA provides, and build it into the ticketing system. I helped build a system that took care of this with ServiceNow a few times now.

At one place we aggressively policed external facing certificates. Don’t follow the process, your service gets whacked.

It’s a process you should look into, because the compliance regimes will start paying attention to it someday soon.

Reply on news.ycombinator.com