http or https authentication for Intranet Web applications
authentication, http, https
Solution
2023 Update
Cloud vendors allow you to automatically provision SSL certificates for non-public domains (e.g. AWS Certificate Manager). There are also self-hosted private certificate managers such as this one.
SSL for intranet/internal cloud connections is strongly recommended and may be required for PCI and SOC 2 certification.
2009 Answer
Purchase a domain and trusted certificate? They are really not that expensive anymore if you shop around.
Having said that, digest access authentication is reasonably safe for authentication. Using http rather than https, all of the information you send across the wire will be plain text even if the password is not. Anyone that can plug a laptop in to your intranet running an application such as WireShark can view all of the information sent back and forth. If you care about that information not being compromised, http will not meet your needs.
Problem
I’m developing an Intranet application and I want to make a secure authentication. One approach can be use “https”. The problem is that the server doesn’t have a trusted certificate, therefore is a bit annoying for the client because the browser doesn’t trust in the certificate and complaints with a scary message. Using http will compromise the user password but it can be combined with “Digest access authentication” What do you think?