Curious to know the security implications and potential risks involved with getting a CA signed cert for localdev.mydomain.com, and issuing it to all the developers who might need to spin up a local SSL server.
Since the key will likely see wide internal distribution, there's a fair chance it could escape into the wild. If so, what could it be used for?
The attack vectors described here, I think, don't apply to local development.
Another potential concern is a malicious party using it on the public internet, but since *.mydomain.com is already owned, said party could not create a website at localdev.mydomain.com - effectively rendering the key useless to them. Yes?