Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Easy HTTPS for your private networks

getlocalcert.net

Post reply on HN
Print view View original

111–120 of 126 posts

Re: Easy HTTPS for your private networks

#111

Post by mgaunard »

pravus wrote: post #70
mgaunard wrote: post #68

The web/cloud world is so much nonsense. First, why do you even need HTTPS on a trusted network. Also if you want a trusted network, why not just use IPSec? HTTPS was specifically built to work over the Internet because it was too hard to switch from IPv4. Second, if it's private, surely you can just use your own Certificate Authority, instead of paying a tax to be listed on someone else's Certificate Authority.

> First, why do you even need HTTPS on a trusted network. PCI compliance among many other regulatory issues. You will be required to show that data is not only encrypted at rest but is encrypted through your entire transport chain regardless of any physical security. The threat model assumes that an attacker is able to temporarily access network resources undetected and can use simple sniffing tools to egress sensiti…

That's a whole lot of nonsense. What if you push your data using a custom binary protocol over UDP multicast?

Are you suggesting that regulations make it so that everything should be a slow and inefficient https webapp?

Re: Easy HTTPS for your private networks

#112

Post by mgaunard »

preseinger wrote: post #109
mgaunard wrote: post #68

The web/cloud world is so much nonsense. First, why do you even need HTTPS on a trusted network. Also if you want a trusted network, why not just use IPSec? HTTPS was specifically built to work over the Internet because it was too hard to switch from IPv4. Second, if it's private, surely you can just use your own Certificate Authority, instead of paying a tax to be listed on someone else's Certificate Authority.

how do you know your network is trusted and/or private? trick question: you can't even the network links between hosts in a single rack in a DC can be vulnerable

I own the machines, the switches, the routers and the cables.

Re: Easy HTTPS for your private networks

#113

Post by cratermoon »

mgaunard wrote: post #112
preseinger wrote: post #109

Earlier quoted context omitted.

how do you know your network is trusted and/or private? trick question: you can't even the network links between hosts in a single rack in a DC can be vulnerable

I own the machines, the switches, the routers and the cables.

And you're certain that no one will ever access your network negligently or with malicious intent?

Re: Easy HTTPS for your private networks

#114

Post by bruce511 »

skrebbel wrote: post #61
bruce511 wrote: post #53

Earlier quoted context omitted.

Let me put it this way; You might get away with installing your RootCA on your in-office PCs that you own. Good luck though getting me to install it on my (external contractor) laptop or my (employee) phone, or my (hosted) VMS machines. -you- may plan to only use the CA for good, but I don't trust you (and by extension all your IT staff, present, past, and future) to be angels.

Kinda nuts actually that you can’t install a Root CA and tell the OS “but only ever use it for these and these domains”. That would solve this elegantly.

Even If you could tell the OS it would fail cause much (most?) software has an OS independent path to validate the certificate.

OpenSSL for example uses a custom pem file that the program developer supplies.

Re: Easy HTTPS for your private networks

#115

Post by 1vuio0pswjnm7 »

Even easier would be to eliminate ICANN DNS and LetsEncrypt as mandatory dependencies for using HTTPS. If I'm the CA then maybe I know what I want to trust. Not every computer network user has same use cases. One size does not fit all, so to speak. If come computer network users want to use third parties to help them figure out who to trust, then they can do so, it's always an option. But currently there are some companies standing in the way of letting any computer network user determine trust themselves. Currently, delegating trust to third parties isn't optional, it's mandatory.

Re: Easy HTTPS for your private networks

#116

Post by worik »

karatinversion wrote: post #91
worik wrote: post #71

Earlier quoted context omitted.

> Your private root CA can be maliciously used to MITM every domain on the Internet I cannot see how. Do you mean as a specific attack on a computer with the private Root CA installed, if the attacker gets their hands on the Root CA private key?

I think OP was envisaging the attack being done by the person whose root CA private key it is.

> I think OP was envisaging the attack being done by the person whose root CA private key it is.

Still very convoluted. I cannot see the problem, beyond some very special cases.

Re: Easy HTTPS for your private networks

#117

Post by 8organicbits »

worik wrote: post #116
karatinversion wrote: post #91

Earlier quoted context omitted.

I think OP was envisaging the attack being done by the person whose root CA private key it is.

> I think OP was envisaging the attack being done by the person whose root CA private key it is. Still very convoluted. I cannot see the problem, beyond some very special cases.

There's two parts. The first is getting access to the private CA's private key. This is easy for insiders who already have access, but challenging for external attackers. The second is performing a MITM attack. You need to establish an in-the-middle network position and then craft certs for the sites you want to intercept. Insiders may already have the needed network position. Outsiders may find this challenging. Crafting a bogus certificate is trivial with a private CA.

Re: Easy HTTPS for your private networks

#118

Post by preseinger »

mgaunard wrote: post #112
preseinger wrote: post #109

Earlier quoted context omitted.

how do you know your network is trusted and/or private? trick question: you can't even the network links between hosts in a single rack in a DC can be vulnerable

I own the machines, the switches, the routers and the cables.

where does all of that hardware live?

unless it's in your home, it's not trustable

Re: Easy HTTPS for your private networks

#119

Post by mgaunard »

wolletd wrote: post #75
mgaunard wrote: post #68

The web/cloud world is so much nonsense. First, why do you even need HTTPS on a trusted network. Also if you want a trusted network, why not just use IPSec? HTTPS was specifically built to work over the Internet because it was too hard to switch from IPv4. Second, if it's private, surely you can just use your own Certificate Authority, instead of paying a tax to be listed on someone else's Certificate Authority.

Well, because my local instance of says, isn't available unless I use HTTPS. Also, HTTPS with a public CA just works on most systems, whereas IPsec requires Client configuration. It's still easier to roll out than switching from IPv4. For personal or experimental things, I may use a local CA, but getting certificates for the internal subdomains of my company is trivial when you already got a public domain on a Server…

Stop relying on web stuff built by others full of artificial limitations?

Either write your own code or choose your dependencies more carefully.

Re: Easy HTTPS for your private networks

#120

Post by mgaunard »

preseinger wrote: post #118
mgaunard wrote: post #112

Earlier quoted context omitted.

I own the machines, the switches, the routers and the cables.

where does all of that hardware live? unless it's in your home, it's not trustable

Have you never been to a datacenter?

They require your fingerprints for entry and everything is heavily monitored.

You can even get a stealthy cage if you don't want anyone to be able to see what kind of network equipment you have.

Post reply on HN