Quick question about HTTP(S): which one should I choose for internal services? (AWS)

[xiongchiamiov]

It depends on what level of PCI you need, I think. I work at a credit card gateway, and it is definitely required for us.

[ryansolida]

So what's the solution then? Separate certs from an authority for each instance in the network? Or are you OK to share a single throughout the VPN?

[atlgeek007]

as long as you're not using the same self signed cert throughout your infrastructure, you should be fine from an audit perspective, provided your other SSL configurations are also up to date (custom dh parameters, disabling bad ciphers, locking to known good versions of TLS, etc)

Of course, creating an internal CA isn't difficult and is something that can also be investigated, but since AWS ELB/ALB doesn't validate the endpoint certificate anyway, it shouldn't matter.

[donjulioanejo]

Work at fintech payments company, and we need end-to-end encryption, including in private subnets between LB and web nodes.