Not sure why you were enabling HTTPS for a project that was not hosting an internet-accessible service, really. By which I assume you mean the service doesn’t have a publicly accessible web based UI or API component. What were you trying to access and how? The only scenario I could think of for this would be that your custom software relies on HTTPS for secure communication within its own internal network (such as on a VPN) to send sensitive data back and forth between services. In which case that feels like overkill for a college course, since you shouldn’t have any genuinely sensitive data that you need to secure if it’s just for testing and demonstration.
It was a project requirement, PHI was processed by it, so yes, it needed a secure connection. I now realize I should have used mutual auth, but hey, I only learned about that after that project
We never sent actual data to it (the actually sensitive data used for training never left a secure VM), but the point of the course was to act like we were. Plus, setting up an nginx reverse proxy is simple, setting it up and getting certs from some ssl commands is a 10 minute task that appeases the project manager/professor with minimal effort.
Not sure why you were enabling HTTPS for a project that was not hosting an internet-accessible service, really. By which I assume you mean the service doesn’t have a publicly accessible web based UI or API component. What were you trying to access and how? The only scenario I could think of for this would be that your custom software relies on HTTPS for secure communication within its own internal network (such as on a VPN) to send sensitive data back and forth between services. In which case that feels like overkill for a college course, since you shouldn’t have any genuinely sensitive data that you need to secure if it’s just for testing and demonstration.
It was a project requirement, PHI was processed by it, so yes, it needed a secure connection. I now realize I should have used mutual auth, but hey, I only learned about that after that project
We never sent actual data to it (the actually sensitive data used for training never left a secure VM), but the point of the course was to act like we were. Plus, setting up an nginx reverse proxy is simple, setting it up and getting certs from some ssl commands is a 10 minute task that appeases the project manager/professor with minimal effort.
deleted by creator