I've been using Terraform (https://www.terraform.io/docs/providers/tls/index.html) lately for local CA's like my homelab. It's nice when you want to keep everything in configuration management. Example of a self-signed CA: https://gitlab.com/failmap/ca/blob/master/ca.tf
Certificates for localhost
11–20 of 157 posts
Re: Certificates for localhost
#12I’ve always liked the concept of a localhost’d web app talking back to a localhost web server. It seems like a great way to get the cross-platform ease of use of developing the UI without having to do everything in browser, so you can optimize the heavy lifting and don’t end up with an Electron app pulling 8Gb of RAM and 100% Of 16 cores.
But I could never quite satisfy the nagging feeling that the localhost server could adequately be secured against outside network requests being routed to it, or as TFA mentions, inside network requests being routed away from it to an outsider!
This article helped enumerate some of the difficulties of securing such a service. Things like a memory-safe parser, checking origins, etc.
I wonder is there a definitive guide someone had setup, or even better a sample Golang or similar localhost server, which demonstrates the dozen-odd layers of checks and protections and magical incantations necessary to have such a server “secure” in the sense that a localhost UI is able to make requests to it to receive sensitive data but it should be safe from external attackers trying to spoof the same requests?
Re: Certificates for localhost
#13The Plex approach to this kind of problem is pretty interesting: https://blog.filippo.io/how-plex-is-doing-https-for-all-its-...
Unfortunately I haven't seen it being done elsewhere. It'd be nice if LetsEncrypt or similar could provide this for more generic everyday use.
Re: Certificates for localhost
#14If you're using ASP.NET Core, this is built into the most recent 2.1 release - local dev cert as well as HTTPS redirection middleware and HSTS in development.
https://blogs.msdn.microsoft.com/webdev/2018/02/27/asp-net-c... https://docs.microsoft.com/en-us/aspnet/core/security/enforc...
As the letsencrypt article points out, you want to start building and testing with HTTPS as early as possible, so this is all wired up as part of creating a new project with ASP.NET Core 2.1.
[disclaimer: on .NET team, Nazgûl]
Re: Certificates for localhost
#15Easiest way is to get a certificate for a subdomain of a domain you own, e.g. dev.example.com, and then point dev.example.com to 127.0.0.1 in your hosts file.
from TFA: >It’s possible to set up your own domain name that happens to resolve to 127.0.0.1, and get a certificate for it using the DNS challenge. However, this is generally a bad idea and there are better options.
I read that as being about the actual public DNS, not your own local hosts file?
Re: Certificates for localhost
#16The Plex approach to this kind of problem is pretty interesting: https://blog.filippo.io/how-plex-is-doing-https-for-all-its-... Unfortunately I haven't seen it being done elsewhere. It'd be nice if LetsEncrypt or similar could provide this for more generic everyday use.
I'm desperate for this. The hardware product I work on can be controlled by a mobile app. It was a very deliberate decision to not make the hardware product and mobile app both have to talk to a remote server acting as a proxy between the two. But that leaves me using plain http between the two.
Re: Certificates for localhost
#17An absolute joke how many loops one needs to go through to do this very basic thing. Hell, this command line is longer than the code required to start a web server in some programming languages.
Re: Certificates for localhost
#18The Plex approach to this kind of problem is pretty interesting: https://blog.filippo.io/how-plex-is-doing-https-for-all-its-... Unfortunately I haven't seen it being done elsewhere. It'd be nice if LetsEncrypt or similar could provide this for more generic everyday use.
I'm desperate for this. The hardware product I work on can be controlled by a mobile app. It was a very deliberate decision to not make the hardware product and mobile app both have to talk to a remote server acting as a proxy between the two. But that leaves me using plain http between the two.
Couldn't you use it to coordinate NAT punchthrough?
Re: Certificates for localhost
#19I’ve always liked the concept of a localhost’d web app talking back to a localhost web server. It seems like a great way to get the cross-platform ease of use of developing the UI without having to do everything in browser, so you can optimize the heavy lifting and don’t end up with an Electron app pulling 8Gb of RAM and 100% Of 16 cores. But I could never quite satisfy the nagging feeling that the localhost server c…
When I was working on e-detailing apps for pharmaceutical sales reps in 2007-2010 we did this. Originally the UI for was based on Flash and intended for Windows Tablet PC usage. I think the server security was pretty rudimentary.
Re: Certificates for localhost
#20I was hoping for a good answer, rather than "this is hard and it will just get worse." We have an old app that my team is modernizing with this exact situation. Uses websockets now, but that's an historical thing and all the web apps were non-secure so it worked okay. Now everyone wants SSL turned on, and this puts the websocket method in jeopardy. Somebody before me decided we should switch all the inter-app communication to an external XMPP server. Ugh.