56
you are viewing a single comment's thread
view the rest of the comments
[-] shalafi@lemmy.world 1 points 1 day ago

I understand all the tech, except why I, as a home user, might want this. For that matter, what's in it for a business user?

I've hosted a dozen different servers from home. FTP, HTTPS, SSH, the usual. What's the advantage of giving up the flexibility of my DNS name? I might save a few bucks a year with Namecheap?

Not saying this is dumb or completely useless, just not seeing much application.

[-] Corbin@programming.dev 4 points 1 day ago

This is for short-lived cloud-allocated (virtual) machines which have an IPv4 address but not necessarily a DNS presence. When there are more than a handful of machines, name management becomes its own unique pain; often, the domain names of such a machine are an opaque string of numbers under some subdomain, and managing the name is not different from managing the raw IP address instead. Similarly, for the case of many machines all serving a wildcard (e.g. a parking page) allocating a single IP-address certificate might be preferable to copying the wildcard certificate to each machine.

As you point out, though, SSH exists and has accumulated several decades of key-management theory. Using HTTPS instead of SSH for two machines with one owner is definitely not what I would do. I've worked at all scales from homelabs to Google and I can't imagine using IP-address certificates for any of it.

Now, with all of that said, if Let's Encrypt were available over e.g. Yggdrasil then there would be a use-case for giving certificates directly to IPv6 addresses and extending PKI to the entire Yggdrasil VPN. That seems like a stretch though.

load more comments (2 replies)
this post was submitted on 03 Jul 2025
56 points (95.2% liked)

Tech

1450 readers
76 users here now

A community for high quality news and discussion around technological advancements and changes

Things that fit:

Things that don't fit

Community Wiki

founded 1 year ago
MODERATORS