>"Eeasy HTTPS"
>Displays somewhat overcomplicated diagram with bunch of arrows and scary technobubble words.
Ping me again when HTTPs actually becomes easy
Easy HTTPS for your private networks
81–90 of 126 posts
Re: Easy HTTPS for your private networks
#82This is unnecessary It is straightforward to create your own Root CA and use it to sign certificates for your private network, using openssl. Ensure that you implement the V3 extensions with @altnames, for the certificates you issue, with a "DNS => " (or you can use an IP address instead of FDN. I have not experimented with that). .local domain names work fine If you do not implement "@altnames" the certificate will…
I've considered doing that for my home network, but if my local CA was ever compromised, someone would be able to generate certs for any site (such as my bank), and my devices would trust those certs if they were able to MitM me. Browsers don't support name constraints, so I couldn't restrict the CA to signing just my local domain.
Yes, I know, I'm small potatoes, and that would require a very targeted attack, but the idea still bothers me.
Re: Easy HTTPS for your private networks
#83I really hope DANE will become more popular (and widely supported) some time. Works great on air gapped networks without the need for a publicly trusted CA or Let's Encrypt. No ACME daemon to monitor, just put your public key in a DNS record an forget about it.
Me too. But the CA and browser mafia is too intertwined to let this change anytime soon.
Are you being facetious or do you actually believe this?
Re: Easy HTTPS for your private networks
#84Cool, but as others said fairly easy to do on your own already. Sort of related but a problem I have been trying to solve is, how to create a trusted certificate for a new device on a private network automatically without any configuration? For example, imagine you are turning up a new router or switch with a Web UI for management. Traditionally this is served on http initially and you can optionally install a cert a…
Solved.
Solved for both Windows and Linux (Debian, Arch, Fedora). I might have unlikely solved this of OSX as well, but I am not buying Apply hardware just to test it.
What my solution does is check for certificates created by the project during a build step. If the certificates don't exist it creates them, installs them in the OS, and also installs them in the browser. Installation in the browsers is required in Linux and only for FireFox in Windows. These are cert chains containing a self-signed root, intermediary CA, and a local domain cert.
I have these certs configured to work with my own domains so that I can connect to a subdomain addressed to a loopback IP and the cert recognizes that domain, but the domain "localhost" works as well. Sometimes its nice to access a real domain to avoid any restrictions imposed upon accessing address "localhost". You just have to change the domains at the bottom of your OpenSSL option files.
Here is how I solved it with vanilla TypeScript in Node.js (also requires locally installed OpenSSL):
* OpenSSL option file 1 - https://github.com/prettydiff/share-file-systems/blob/master...
* OpenSSL option file 2 - https://github.com/prettydiff/share-file-systems/blob/master...
* Certificate library - https://github.com/prettydiff/share-file-systems/blob/master...
* Certificate interface from build tool - https://github.com/prettydiff/share-file-systems/blob/master...
* Certificate installation - https://github.com/prettydiff/share-file-systems/blob/master...
If you have any questions just open a Github issue on the project.
Re: Easy HTTPS for your private networks
#85I really hope DANE will become more popular (and widely supported) some time. Works great on air gapped networks without the need for a publicly trusted CA or Let's Encrypt. No ACME daemon to monitor, just put your public key in a DNS record an forget about it.
> Works great on air gapped networks
I've usually seen DANE paired with DNSSEC, and on the internet it feels required. DANE on an air gapped network is new to me, do you just skip the DNSSEC part? I'd be fearful of joining a network that puts bogus DANE TLSA records for google.com, for example.
Browser support for DANE is at 0%, unfortunately.
Re: Easy HTTPS for your private networks
#86Earlier quoted context omitted.
This is a poor solution to a non-problem. 99% of "private networks" don't need HTTPS for most things, full-stop. Those that do, the correct solution is to deploy a private CA and use internal DNS. The implication being you do not trust your network. So the solution is to.....use public DNS and Let's Encrypt garbageware and leak details of your internal network so you can pretend you're now more secure because the caf…
> This is a poor solution to a non-problem. 99% of "private networks" don't need HTTPS for most things, full-stop. The problem with your security model is that you assume your private network is flawless. Do you really think you can trust every device that connects to your network to be secure? Including your Wi-Fi router? Because I don't, even for devices I personally bought. Even less so in a corporate setting.
If you don't trust your router I recommend trying out an open source firmware, like OpenWRT or DD-WRT.
Re: Easy HTTPS for your private networks
#87Or, it's super easy to roll your own using letsencrypt. 1. Buy your own public domain (such as companyname.dev) 2. Setup a LetsEncrypt wildcard certificate with DNS validation 3. Update your /etc/hosts to something like `127.0.0.1 companyname.dev` We have this working with multiple developers, each renewing their certificates themselves. Works great, it's simple, and don't need to trust an extra third party.
The big difference I can see is that getlocalcert.net does not require the user to run a DNS server.
Re: Easy HTTPS for your private networks
#88Earlier quoted context omitted.
Correct, a distinction with this service is that the domain names are free. One part of my decision to build this service was the fall of freenom (free domain names). Typically free domain name services are full of spam, malware, and other junk. getlocalcert seeks to avoid that as it only permits private network usage. My hope is that this model can serve that niche while avoiding abuse.
How will you make money?
I'm potentially using this as a portfolio piece for my freelance consulting work [1]. Many clients require NDAs, so it can be tough to talk about specific, recent accomplishments.
Operational costs are low: around $40/year in domains and $20/month in servers. Soliciting donations could probably cover that (some similar free services work that way).
Re: Easy HTTPS for your private networks
#89Earlier quoted context omitted.
How will you make money?
I'm potentially using this as a portfolio piece for my freelance consulting work [1]. Many clients require NDAs, so it can be tough to talk about specific, recent accomplishments. Operational costs are low: around $40/year in domains and $20/month in servers. Soliciting donations could probably cover that (some similar free services work that way). [1] https://www.robalexdev.com/
With your work history, you probably don't need any portfolio projects ;)
Re: Easy HTTPS for your private networks
#90I wrote about something along these lines a couple of years ago [0] and thought the idea was dead due to rate limiting. But does LE now regard each subdomain as having its own limit, rather than taking that of the parent domain? [0] https://3dbrows.dev/
The limit can be increased in some cases. https://letsencrypt.org/docs/rate-limits/#a-id-overrides-a-o...
I think options are expanding now. ZeroSSL offers ACME certs without rate limits. You'll likely need to pay them if you're getting more than three.