Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Easy HTTPS for your private networks

getlocalcert.net

Post reply on HN
Print view View original

71–80 of 126 posts

Re: Easy HTTPS for your private networks

#71

Post by worik »

8organicbits wrote: post #43
worik wrote: post #16

This is unnecessary It is straightforward to create your own Root CA and use it to sign certificates for your private network, using openssl. Ensure that you implement the V3 extensions with @altnames, for the certificates you issue, with a "DNS => " (or you can use an IP address instead of FDN. I have not experimented with that). .local domain names work fine If you do not implement "@altnames" the certificate will…

I've been pretty frustrated with how private CAs are supported. Your private root CA can be maliciously used to MITM every domain on the Internet, even though you intend to use it for only a couple domain names. Most people forget to set Name Constraints when they create these and many helper tools lack support [1][2]. Worse, browser support for Name Constraints has been slow [3] and support isn't well tracked [4]. P…

> Your private root CA can be maliciously used to MITM every domain on the Internet

I cannot see how. Do you mean as a specific attack on a computer with the private Root CA installed, if the attacker gets their hands on the Root CA private key?

Re: Easy HTTPS for your private networks

#72

Post by dvdkon »

mgaunard wrote: post #68

The web/cloud world is so much nonsense. First, why do you even need HTTPS on a trusted network. Also if you want a trusted network, why not just use IPSec? HTTPS was specifically built to work over the Internet because it was too hard to switch from IPv4. Second, if it's private, surely you can just use your own Certificate Authority, instead of paying a tax to be listed on someone else's Certificate Authority.

Trusted networks are a flawed concept, unless you mean a software-backed tunnel. And I'm glad the slightly-less-mad TLS won over IPSEC with some certificate extension.

Re: Easy HTTPS for your private networks

#73

Post by worik »

nine_k wrote: post #48
worik wrote: post #16

This is unnecessary It is straightforward to create your own Root CA and use it to sign certificates for your private network, using openssl. Ensure that you implement the V3 extensions with @altnames, for the certificates you issue, with a "DNS => " (or you can use an IP address instead of FDN. I have not experimented with that). .local domain names work fine If you do not implement "@altnames" the certificate will…

This sounds very much like the famous HN comment saying that Dropbox is unnecessary because you can construct an analog using rsync and half-dozen other tools. It's like saying that having a chair is unnecessary because you have a log, an axe, a saw, etc, and can build a sit to your liking when need be. The thing is that when the need actually comes to be, you want a seat right now and of a known working kind, and st…

The thing is when you build a private network you want it to be private.

The thing is when you are securing a network you are building things with powerful tools.

Thing is using powerful tools can backfire badly.

Re: Easy HTTPS for your private networks

#74

Post by worik »

throwanem wrote: post #44
attentive wrote: post #36

Earlier quoted context omitted.

What is often not straightforward is trusting this CA on every existing and future client.

Especially if it's an iPhone.

> Especially if it's an iPhone.

That was my exact problem, an why I learnt this.

It is easy to install and easy to remove from an iOS device.

Re: Easy HTTPS for your private networks

#75

Post by wolletd »

mgaunard wrote: post #68

The web/cloud world is so much nonsense. First, why do you even need HTTPS on a trusted network. Also if you want a trusted network, why not just use IPSec? HTTPS was specifically built to work over the Internet because it was too hard to switch from IPv4. Second, if it's private, surely you can just use your own Certificate Authority, instead of paying a tax to be listed on someone else's Certificate Authority.

Well, because my local instance of says, isn't available unless I use HTTPS.

Also, HTTPS with a public CA just works on most systems, whereas IPsec requires Client configuration. It's still easier to roll out than switching from IPv4.

For personal or experimental things, I may use a local CA, but getting certificates for the internal subdomains of my company is trivial when you already got a public domain on a Server that's capable of using DNS-01 challenges.

Enabling HTTPS is just way easier than actually ensuring you can trust your local network. Many real-life middle-class companies start out with just having a network and not thinking about security at all. Some companies may even have untrusted internal networks by choice by allowing BYOD.

Re: Easy HTTPS for your private networks

#76

Post by jart »

8organicbits wrote: post #51
jart wrote: post #45

Earlier quoted context omitted.

Your private root CA can only be used maliciously if it's compromised. If you use certificate transparency to publicly leak all your local network administrative activities, then you won't need to worry about someone compromising your network because you've already compromised yourself.

Compromise of private CAs isn't always difficult. People store unencrypted keys on SharePoint or send them in email along with the password. There's also cases of rogue IT department staff using the private CA intended to be used for `*.corp` to MITM employee Internet traffic, so "compromise" isn't needed for harm to occur. For companies that do it right, yeah, the concern is minimal. I think the risk of leaking inte…

Sharepoint and email servers aren't public. Transparency logs are. Small companies might not care if the public knows what they're doing. In fact they'd probably benefit from the attention. However other companies are concerned, since leaks can fuel media rumors, harmful stock trades, or worse.

Re: Easy HTTPS for your private networks

#77

Post by ushakov »

8organicbits wrote: post #24
Humphrey wrote: post #21

Or, it's super easy to roll your own using letsencrypt. 1. Buy your own public domain (such as companyname.dev) 2. Setup a LetsEncrypt wildcard certificate with DNS validation 3. Update your /etc/hosts to something like `127.0.0.1 companyname.dev` We have this working with multiple developers, each renewing their certificates themselves. Works great, it's simple, and don't need to trust an extra third party.

Correct, a distinction with this service is that the domain names are free. One part of my decision to build this service was the fall of freenom (free domain names). Typically free domain name services are full of spam, malware, and other junk. getlocalcert seeks to avoid that as it only permits private network usage. My hope is that this model can serve that niche while avoiding abuse.

How will you make money?

Re: Easy HTTPS for your private networks

#79

Post by ori_prior »

donselaar wrote: post #58

I really hope DANE will become more popular (and widely supported) some time. Works great on air gapped networks without the need for a publicly trusted CA or Let's Encrypt. No ACME daemon to monitor, just put your public key in a DNS record an forget about it.

Me too. But the CA and browser mafia is too intertwined to let this change anytime soon.

Re: Easy HTTPS for your private networks

#80

Post by Jnr »

3dbrows wrote: post #78

I wrote about something along these lines a couple of years ago [0] and thought the idea was dead due to rate limiting. But does LE now regard each subdomain as having its own limit, rather than taking that of the parent domain? [0] https://3dbrows.dev/

The limit can be increased in some cases. https://letsencrypt.org/docs/rate-limits/#a-id-overrides-a-o...
Post reply on HN