Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Easy HTTPS for your private networks

getlocalcert.net

Post reply on HN
Print view View original

1–10 of 126 posts

Re: Easy HTTPS for your private networks

#3

Post by jareklupinski »

interesting, wonder if this will help me get access to the Geolocation API for my ESP32 captive portal devices

on connect, a user is presented with an option to preselect a wifi network and input their geographic location. I managed to stuff a zip code lookup table into the code, but lat/long is really cumbersome to input, and using the phone's location sensor requires an HTTPS server

Re: Easy HTTPS for your private networks

#4

Post by frfl »

Haven't used this myself, but I did find out about Lego (https://github.com/go-acme/lego) recently and used it to get a Let's Encrypt cert for a local network website I have using the DNS challenge. It was fairly straight forward,

  $ export NAMESILO_API_KEY=...
  $ export NAMESILO_POLLING_INTERVAL=10
  $ export NAMESILO_PROPAGATION_TIMEOUT=1800
  $ export NAMESILO_TTL=3600
  $ lego --email  --dns namesilo --domains *..com run

Re: Easy HTTPS for your private networks

#6

Post by 8organicbits »

urda wrote: post #5

I recommend just using something like XCA [1]. Just configure your own root CA and distribute it. [1] https://hohnstaedt.de/xca/

Part of the reason I've been working on this is that the "distribute" step is quite difficult to do at scale across an ever changing set of operating systems and devices. Using a free public CA like Let's Encrypt let's you avoid that challenge since it's trusted out of the box everywhere.

Re: Easy HTTPS for your private networks

#8

Post by andrewmcwatters »

If you absolutely need a hostname that is not "localhost" you should still configure your own host record and use a utility like mkcert.[1]

Most of the time, you really shouldn't need this, and your local HTTPS development should just require:

    mkcert -install
    mkcert localhost
In the directory of your app, etc.

If you're deploying private applications, these records should exist in your intranet DNS resolver instead.

[1]: https://github.com/FiloSottile/mkcert

Re: Easy HTTPS for your private networks

#9

Post by abound »

urda wrote: post #5

I recommend just using something like XCA [1]. Just configure your own root CA and distribute it. [1] https://hohnstaedt.de/xca/

Doesn't that require being able to add your root CA on each device you access the application from? That can be a chore in some cases, esp when you want to share the application with others.

For services I host on my Tailscale/Headscale network, I just use DNS challenges. With Cloudflare and Caddy, it's as straightforward as adding:

tls { dns cloudflare {env.CLOUDFLARE_AUTH_TOKEN} }

to the site's configuration in the Caddyfile

Post reply on HN