| 5 Mar 2022 |
 Winter (she/her) | got it | 19:53:48 |
 m1cr0man | * yeah exactly | 19:53:49 |
| Winter (she/her) |
Secondly there was in the past some concern raised around granting acme group to other services because it would grant that service access to more certs than you may want. You might get some backlash in that regard. In reality, this is hard to operate around and for wildcard certs you're likely to only have 1 cert shared across multiple services anyway.
so the thing about this point is that, like, if you set a specific group for a cert (that isn't acme), then its not like granting the acme group will give you access to those...
| 19:54:47 |
| Winter (she/her) | it'll just give the acme owned ones | 19:54:55 |
| Winter (she/her) | like, i get the issue in theory, and i agree with it
but not practically? | 19:55:08 |
| Winter (she/her) | like i guess it's just about reducing attack surface no matter the setup | 19:55:18 |
| m1cr0man | well if you aren't using wildcards its more apparent - certs for each service, with the group assigned appropriately | 19:55:39 |
| Winter (she/her) | but giving the acme group won't give access to those? | 19:55:58 |
| Winter (she/her) | that's the point i'm trying to make, unless i'm wrong | 19:56:07 |
| m1cr0man | yeah but then you're granting acme group to N service accounts rather than just setting the cert group | 19:56:14 |
| Winter (she/her) | right | 19:56:36 |
