• 0 Posts
  • 78 Comments
Joined 2 years ago
cake
Cake day: June 21st, 2024

help-circle





  • There was no reason for this in the first place in my opinion. The ONLY positive use I can see would be managing the whole arr stack from one place, but I imagine you would still need to manage individual shows\movies\whathaveyou if it wasn’t found in the first place.

    I have my stacks set up to auto upgrade and find missing stuff already. It’s literally built into their programming. I manage them individually and anything that isn’t found on my indexers I typically go out and find manually as needed (old or very obscure media).

    Not really sure what this bought anyone at all other than an extra layer of convenience?











  • One such app I can think of would be a client side issue. If the public cert doesnt match the back end private cert it will sever the connection and mark it as insecure. Hopefully I won’t need to deal with it much longer though.

    I just heard back from my other team that “this project sounds great for your team” even though they manage many of their own apps and certificates. Perhaps I should just let them burn then!


  • Unfortunately some apps require the certificate be bound to the internal application, and need to be done so through cli or other methods not easily automated. We could front load over reverse proxy but we would still need to take the proxy cert and bind to the internal service for communication to work properly. Thankfully that’s for my other team to figure out as I already have a migration plan for systems I manage.




  • While I agree for my personal use, it’s not so easy in an enterprise environment. I’m currently working to get services migrated OFF my servers that utilize public certificates to avoid the headache of manual intervention every 45 days.

    While this is possible for servers and services I manage, it’s not so easy for other software stacks we have in our environment. Thankfully I don’t manage them, but I’m sure I’ll be pulled into them at some point or another to help figure out the best path forward.

    The easy path is obviously a load balanced front-end to load the certificate, but many of these services are specialized and have very elaborate ways to bind certificates to services outside of IIS or Apache, which would need to trust the newly issued load balancer CA certificate every 47 days.