Hacker News Reader

Comment by originalvichy | Hacker News Reader

I think the hard part about DNS is not the public facing resolution of addresses, but rather how to understand it in enterprise environments.

A junior tasked with creating a DNS record in an enterprises servers will have to go through a wild ride to just get that record created and set in a correct manner. Even worse, if a service has to be reachable through an internal DNS entry and external DNS entry.

Not only is it stressful to find the IT deities to grant the junior their wish, it can be a monetary issue as well if the company needs to re-order public certs in case of mistakes.

View on HN

The absurdity is striking when you see all this process around DNS in a large org, and then you remember that DNS was invented as a way of permitting delegation of authority, away from the centre.

I've seen it takes weeks to get a DNS record configured in a large org. I'm talking something that should be simple, like adding a CNAME or A record for a new site.

Bonus points when it's spread across a bunch of different registrars and they refuse to delegate nameservers because of office politics, making things way more complicated to deploy and maintain.

Humble question: Why not use Let's encrypt via DNS API? Works both internally & on public networks.

Let's Encrypt is only 8 years old, that's not enough time for a lot of corporate IT policies to allow its usage.

In an "Enterprise" setting, the dev or ops team that needs certificates for internal services often has no direct access to the company's external web site or DNS, which may be owned by some other team like marketing or IT. So the options can boil down to jumping through bureaucratic hoops (if they even exist) for every request, or kludge together some other half-baked system that sorta gets the job done. Ask me how I know.

Makes sense. I mean, in case of wildcard certificates, number of requests/access could be reduced to 1x per subdomain, but still. I have the same problem at my university.

Reply on news.ycombinator.com