Fully agree with @SASKiwi Personally I would also recommend that new SAS systems just get deployed as HTTPS and be done with it. As @SASKiwi said, if it's not an requirement today, it will be tomorrow. So why is HTTPS not the default ? IMHO....TLS adds some complexity to the installation. The installer/admin team needs a good understanding of how TLS works. There are three domains you need to understand TLS, SAS and TLS+SAS. If the installer/admin team is not familiar with TLS+SAS, I would not suggest they try TLS out of the box. I think if you have TLS as the default for SAS, you'll have many failed deployments out there since it's actually a very rare skill out there. I'm not saying don't do TLS, I'm saying make sure you have the skills before you launch into a TLS deployment, during an installation or post. Secondly, certificates might incur a cost if certs are third-party signed. So make sure about the process and costs for obtaining certificates. Lastly, for environments that hold no sensitive information, an organisation MIGHT elect not to apply TLS. So it's very possible that your UAT and PROD environments have TLS, but not DEV. Again, organisational policies. So my point is, TLS is a tool in the IT security toolbox. You and your organisation needs to decide what tools you use in your security framework. Neither SAS or this forum can do this. Hope this helps.
... View more
