Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Easy HTTPS for your private networks

getlocalcert.net

Post reply on HN
Print view View original

121–126 of 126 posts

Re: Easy HTTPS for your private networks

#121

Post by throwanem »

worik wrote: post #74
throwanem wrote: post #44

Earlier quoted context omitted.

Especially if it's an iPhone.

> Especially if it's an iPhone. That was my exact problem, an why I learnt this. It is easy to install and easy to remove from an iOS device.

I would love to know how!

I've never had success with local CAs and self-signed certs on iPhone, despite going through the whole rigamarole of creating and installing an MDM profile with the trust root. Even after doing that, apps and Safari behave as if the certificate was untrusted. Is there some documentation you've successfully used and wouldn't mind pointing to?

Re: Easy HTTPS for your private networks

#122

Post by esbeeb »

8organicbits wrote: post #31
esbeeb wrote: post #25

Earlier quoted context omitted.

Last time I checked, those wildcard LetsEncrypt certs take more work to get, like passing a DNS-based TXT record challenge. Then once you have the wildcard certs, they only last 3 months. Once obtained, they can manually be copied into the LAN using a tool like wormhole. There's a lot of manual steps here which are far harder than how certbot will auto-renew certs when in the cloud - usually requiring no manual inter…

One of my inspirations for getlocalcert is a tool to make DNS-01 easier. acme-dns let's you add a CNAME to another DNS zone, which let's you issue certificates for the former domain name using a convenient API for the latter zone. Seriously read about it, it's awesome. https://github.com/joohoi/acme-dns/ That tool is open source and self-hostable. getlocalcert also provides this feature, but as a hosted service. Choo…

Thanks for the explanations! Great links.

Re: Easy HTTPS for your private networks

#123

Post by worik »

jart wrote: post #76
8organicbits wrote: post #51

Earlier quoted context omitted.

Compromise of private CAs isn't always difficult. People store unencrypted keys on SharePoint or send them in email along with the password. There's also cases of rogue IT department staff using the private CA intended to be used for `*.corp` to MITM employee Internet traffic, so "compromise" isn't needed for harm to occur. For companies that do it right, yeah, the concern is minimal. I think the risk of leaking inte…

Sharepoint and email servers aren't public. Transparency logs are. Small companies might not care if the public knows what they're doing. In fact they'd probably benefit from the attention. However other companies are concerned, since leaks can fuel media rumors, harmful stock trades, or worse.

More to the point if you cannot keep one file a secret your problems are quite large.

Those sort of problems are common, true. That is saying that competence is rare in computing.

That is not surprising given the almost complete lack of accountability in this space.

Re: Easy HTTPS for your private networks

#124

Post by doubled112 »

throwanem wrote: post #121
worik wrote: post #74

Earlier quoted context omitted.

> Especially if it's an iPhone. That was my exact problem, an why I learnt this. It is easy to install and easy to remove from an iOS device.

I would love to know how! I've never had success with local CAs and self-signed certs on iPhone, despite going through the whole rigamarole of creating and installing an MDM profile with the trust root. Even after doing that, apps and Safari behave as if the certificate was untrusted. Is there some documentation you've successfully used and wouldn't mind pointing to?

This has changed recently, because I did a lot of fighting with this at one point.

Download the certificate, import/install it, and then do this: https://support.apple.com/en-us/HT204477

Re: Easy HTTPS for your private networks

#125

Post by preseinger »

mgaunard wrote: post #120
preseinger wrote: post #118

Earlier quoted context omitted.

where does all of that hardware live? unless it's in your home, it's not trustable

Have you never been to a datacenter? They require your fingerprints for entry and everything is heavily monitored. You can even get a stealthy cage if you don't want anyone to be able to see what kind of network equipment you have.

and a government warrant bypasses all of that

there was this whole thing with edward snowden a few years ago, maybe you remember?

Re: Easy HTTPS for your private networks

#126

Post by throwanem »

doubled112 wrote: post #124
throwanem wrote: post #121

Earlier quoted context omitted.

I would love to know how! I've never had success with local CAs and self-signed certs on iPhone, despite going through the whole rigamarole of creating and installing an MDM profile with the trust root. Even after doing that, apps and Safari behave as if the certificate was untrusted. Is there some documentation you've successfully used and wouldn't mind pointing to?

This has changed recently, because I did a lot of fighting with this at one point. Download the certificate, import/install it, and then do this: https://support.apple.com/en-us/HT204477

Thank you! This is new since the last time I tried setting up a CA for my home network, and it looks like just the ticket.
Post reply on HN