Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Easy HTTPS for your private networks

getlocalcert.net

Post reply on HN
Print view View original

91–100 of 126 posts

Re: Easy HTTPS for your private networks

#91

Post by karatinversion »

worik wrote: post #71
8organicbits wrote: post #43

Earlier quoted context omitted.

I've been pretty frustrated with how private CAs are supported. Your private root CA can be maliciously used to MITM every domain on the Internet, even though you intend to use it for only a couple domain names. Most people forget to set Name Constraints when they create these and many helper tools lack support [1][2]. Worse, browser support for Name Constraints has been slow [3] and support isn't well tracked [4]. P…

> Your private root CA can be maliciously used to MITM every domain on the Internet I cannot see how. Do you mean as a specific attack on a computer with the private Root CA installed, if the attacker gets their hands on the Root CA private key?

I think OP was envisaging the attack being done by the person whose root CA private key it is.

Re: Easy HTTPS for your private networks

#92

Post by mananaysiempre »

hartmel wrote: post #64
seiferteric wrote: post #34

Cool, but as others said fairly easy to do on your own already. Sort of related but a problem I have been trying to solve is, how to create a trusted certificate for a new device on a private network automatically without any configuration? For example, imagine you are turning up a new router or switch with a Web UI for management. Traditionally this is served on http initially and you can optionally install a cert a…

There is SCEP ( https://en.m.wikipedia.org/wiki/Simple_Certificate_Enrollmen... ) which allows that and is often found on network devices. You need a PKI which exposes a SCEP endpoint (ejbca or dogtag supports this). That the certificate is used as certificate for the HTTPS is up to the device implementation of the scep client or something else in the client though. On servers, certmonger can do scep iirc. On private…

> You need a PKI which exposes a SCEP endpoint (ejbca or dogtag supports this).

Uhh...

> [...] ejbca [...]

Now you have two problems.

What I mean is, if you’ve been already running EJBCA for whatever reason then this is perhaps reasonable, but if your current setup is at the level of typing `openssl req` into a terminal (whether that’s a good idea or not), it sounds like a lot of additional complexity. (Can’t say anything about dogtag.)

I’ve been waiting forever for somebody to add an ACME backend to the Go SCEP library[1], but it doesn’t look like that has happened. In the meantime it includes a fairly competent standalone CA server at the abovementioned invoke-openssl-by-hand level.

Note that SCEP basically requires a trusted network, though, from what I remember.

[1] https://github.com/micromdm/scep

Re: Easy HTTPS for your private networks

#93

Post by denton-scratch »

8organicbits wrote: post #37
seiferteric wrote: post #34

Cool, but as others said fairly easy to do on your own already. Sort of related but a problem I have been trying to solve is, how to create a trusted certificate for a new device on a private network automatically without any configuration? For example, imagine you are turning up a new router or switch with a Web UI for management. Traditionally this is served on http initially and you can optionally install a cert a…

You can get somewhat close to that with getlocalcert. When the device first boots, it calls the getlocalcert API to register a free, anonymous domain name (negative: its a UUID domain, ugly). You'd need outbound connections to api.getlocalcert.net and an ACME certificate authority (Let's Encrypt) to issue a ccertificate. When the user connects to " rel="nofollow noreferrer">http:// it redirects to .localcert.net" rel…

> it calls the getlocalcert API to register a free, anonymous domain name

...rather than to get an actual certificate.

I didn't dig past the front page, but as far as I can see, they don't issue HTTPS certs at all, easy or oherwise; they offer managed DNS subdomains. You want a cert, you have to get it somewhere else.

Re: Easy HTTPS for your private networks

#94

Post by loufe »

I'm fairly ignorant for certificates, but would anybody here happen to know whether this tech would be easily implemented on a Synology NAS? I enabled HTTPS on a NAS but figuring out how to get a let's encrypt cert or even a locally trusted cert to work seemed more difficult than anticipated.

Re: Easy HTTPS for your private networks

#96

Post by throw0101c »

This leverages the ACME DNS server which has a REST API:

* https://github.com/joohoi/acme-dns

If your DNS provider has an API, you can hook into that for internal-only web servers; this handy code supports several dozen APIs so you don't have to re-invent the wheel:

* https://github.com/AnalogJ/lexicon

* https://pypi.org/project/dns-lexicon/

* https://dns-lexicon.readthedocs.io/en/latest/user_guide.html

Re: Easy HTTPS for your private networks

#97

Post by BeefWellington »

kelnos wrote: post #82
worik wrote: post #16

This is unnecessary It is straightforward to create your own Root CA and use it to sign certificates for your private network, using openssl. Ensure that you implement the V3 extensions with @altnames, for the certificates you issue, with a "DNS => " (or you can use an IP address instead of FDN. I have not experimented with that). .local domain names work fine If you do not implement "@altnames" the certificate will…

I've considered doing that for my home network, but if my local CA was ever compromised, someone would be able to generate certs for any site (such as my bank), and my devices would trust those certs if they were able to MitM me. Browsers don't support name constraints, so I couldn't restrict the CA to signing just my local domain. Yes, I know, I'm small potatoes, and that would require a very targeted attack, but th…

My local CA is on a raspberry pi that is offline. :)

However, my paranoia level is high.

Re: Easy HTTPS for your private networks

#98

Post by donselaar »

8organicbits wrote: post #85
donselaar wrote: post #58

I really hope DANE will become more popular (and widely supported) some time. Works great on air gapped networks without the need for a publicly trusted CA or Let's Encrypt. No ACME daemon to monitor, just put your public key in a DNS record an forget about it.

> Works great on air gapped networks I've usually seen DANE paired with DNSSEC, and on the internet it feels required. DANE on an air gapped network is new to me, do you just skip the DNSSEC part? I'd be fearful of joining a network that puts bogus DANE TLSA records for google.com, for example. Browser support for DANE is at 0%, unfortunately. https://caniuse.com/?search=dane

You're right that DANE kind of implies DNSSEC. Technically it can go without, but it's quite pointless to do because you cannot trust your TLSA record without DNSSEC.

DNSSEC works in an air gapped network when you deploy your own trust anchor in your DNS. I wouldn't touch a domain name that you don't own yourself (like google.com) but instead only use a domain name you purchased.

It surprises me that DANE is even listed on caniuse.com! I expected it to be way to exotic to be on that list. I'm under no illusion that browsers are going to support this anytime soon unfortunately.

Now let's hope I didn't wake up tptacek to lecture us on how DNSSEC is bad and how it will eat your children. ;)

Re: Easy HTTPS for your private networks

#99

Post by e12e »

Humphrey wrote: post #65
klysm wrote: post #23

Earlier quoted context omitted.

Just at the whole domain or does each dev make their own subdomain?

We setup each project with it's own subdomain... so a /etc/hosts file would be something like 127.0.0.1 client7.companyname.dev our-amazing-product.companyname.dev postgres2.companyname.dev So, then we can use the same settings, etc across devs. Then each dev just runs the script to renew the script as they are needed (no need to share certs between devs)

Why not put project.companyname.dev in DNS? (Pointing to 127.0.0.1, ::1?)

Re: Easy HTTPS for your private networks

#100

Post by 8organicbits »

denton-scratch wrote: post #93
8organicbits wrote: post #37

Earlier quoted context omitted.

You can get somewhat close to that with getlocalcert. When the device first boots, it calls the getlocalcert API to register a free, anonymous domain name (negative: its a UUID domain, ugly). You'd need outbound connections to api.getlocalcert.net and an ACME certificate authority (Let's Encrypt) to issue a ccertificate. When the user connects to " rel="nofollow noreferrer">http:// it redirects to .localcert.net" rel…

> it calls the getlocalcert API to register a free, anonymous domain name ...rather than to get an actual certificate. I didn't dig past the front page, but as far as I can see, they don't issue HTTPS certs at all, easy or oherwise; they offer managed DNS subdomains. You want a cert, you have to get it somewhere else.

As a security engineer I'm wary of tools that offer to issue certificates for you. You've got to trust that they won't keep a copy of your private key. ACME clients [1] generate keys on your device, which is the recommended way.

But you're right. Issuing Let's Encrypt certificates on behalf of users could simplify the process even more.

[1] https://docs.getlocalcert.net/acme-clients/#setting-txt-reco...

Post reply on HN