I am using AWS ACMPCA to create a private CA to generate ssl certs for use in my private subnet. The certs that are created are self-signed by default. But now things like curl and python's request library throw an error because the cert can't be verified because it is self-signed. Is this the intended behavior or not? It seems anti pattern to me if I have to pass --insecure in a curl request, or modify application code to disable verification. But then I can't find any docs on non self-signed certs from a private CA. What is the intended use case? Is it overkill to use https in a private subnet anyways?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.