组织内的 SSL 证书

Question

I would like to know how CA signed SSL certificates are used within an organization for inter-service/apps communication (All apps internal to the org)

Lets say app ABC has generated a cert and has chained it with its company's CA signed cert. Now another app XYZ would like to use ABC's restful service over HTTPS.

1. Should XYZ import ABC's certificate into its keystore ?

2. Is there a way for XYZ to interact with ABC without importing ABC's cert ?

3. How would this play out in AWS Cloud, given ABC & XYZ are in the same VPC ?

Answer 1

You need to import the root certificate of your CA into the trusted root certificate store of all servers/ PCs that will use a service with such certificate.

You only need to register this one certificate, all certificates issued by the CA will then be trusted.

It doesn't make a difference if apps are in the same VPC or not. The only way to get around this is to use normal http