フリー問題

問題文

An organization needs certificates for hundreds of internal services and a handful of public sites. Which allocation minimizes cost and effort?

選択肢

1. Issue everything from an authority the organization manages, because a private authority can be added to the trust store of every client on the internet through the certificate bundle mechanism.
2. Use one chain that mixes key algorithm families to cover both cases.
3. Issue the internal certificates from an authority the organization manages, and import externally issued certificates for the public sites.
4. Import externally issued certificates for everything, because a single source is simpler to reason about and the renewal work is the same in both cases.