Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Running one’s own root Certificate Authority in 2023

wejn.org

Post reply on HN
Print view View original

31–40 of 164 posts

Re: Running one’s own root Certificate Authority in 2023

#31

Post by xg15 »

fiddlerwoaroof wrote: post #4
NegativeK wrote: post #2

I went with DNS based Let's Encrypt for internal certificates, since I'm okay leaking my internal DNS names. > An obvious downside of this is having to guard a bunch of secrets and the need to rotate the host certificates yearly – because Apple says so. The guarding secrets thing makes me too uncomfortable with managing my own CA. I'm sure it'd be fine, but since there are other equivalent and safer ways to do it.. N…

The one thing you can’t do with Let’s Encrypt is generate a certificate with a CN of localhost which, since browsers are getting really picky about mixed HTTP/HTTPS content, is a real issue with local development using certain web features.

> is a real issue with local development using certain web features.

Is it? I thought browsers treat localhost/127.0.0.* specifically as if it were served over https, even if it isn't - otherwise, you could basically forget developing anything locally.

Is there any feature which doesn't treat localhost as a secure origin?

I figure you can always buy a hostname, get a cert using the DNS-01 challenge, then resolve the domain to 127.0.0.1 though - or getting back to the OP and running a custom CA.

Re: Running one’s own root Certificate Authority in 2023

#32

Post by fiddlerwoaroof »

xg15 wrote: post #31
fiddlerwoaroof wrote: post #4

Earlier quoted context omitted.

The one thing you can’t do with Let’s Encrypt is generate a certificate with a CN of localhost which, since browsers are getting really picky about mixed HTTP/HTTPS content, is a real issue with local development using certain web features.

> is a real issue with local development using certain web features. Is it? I thought browsers treat localhost/127.0.0.* specifically as if it were served over https, even if it isn't - otherwise, you could basically forget developing anything locally. Is there any feature which doesn't treat localhost as a secure origin? I figure you can always buy a hostname, get a cert using the DNS-01 challenge, then resolve the…

I have a dashboard I run via nginx on localhost that makes a bunch of requests to various https endpoints. It definitely doesn’t just work unless you have a trusted SSL certificate and run localhost as HTTPS

Re: Running one’s own root Certificate Authority in 2023

#33

Post by denysvitali »

codetrotter wrote: post #18

I run a squid proxy with TLS intercept on a raspberry pi, with my own CA. I have things set up so that the RPi connects to a WiFi, and then a cable from the RPi goes to another WiFi router. I connect my MacBook Pro to that other router. This way the MacBook Pro cannot reach the internet. Then I set the http and https proxy configs in Firefox so that it goes via the squid on the RPi. And I have the root CA from the RP…

You can use a transparent proxy to avoid this

Re: Running one’s own root Certificate Authority in 2023

#34

Post by xg15 »

fiddlerwoaroof wrote: post #32
xg15 wrote: post #31

Earlier quoted context omitted.

> is a real issue with local development using certain web features. Is it? I thought browsers treat localhost/127.0.0.* specifically as if it were served over https, even if it isn't - otherwise, you could basically forget developing anything locally. Is there any feature which doesn't treat localhost as a secure origin? I figure you can always buy a hostname, get a cert using the DNS-01 challenge, then resolve the…

I have a dashboard I run via nginx on localhost that makes a bunch of requests to various https endpoints. It definitely doesn’t just work unless you have a trusted SSL certificate and run localhost as HTTPS

Huh, that's odd. Gonna test this as well then.

Re: Running one’s own root Certificate Authority in 2023

#35

Post by codetrotter »

lini wrote: post #27
codetrotter wrote: post #18

I run a squid proxy with TLS intercept on a raspberry pi, with my own CA. I have things set up so that the RPi connects to a WiFi, and then a cable from the RPi goes to another WiFi router. I connect my MacBook Pro to that other router. This way the MacBook Pro cannot reach the internet. Then I set the http and https proxy configs in Firefox so that it goes via the squid on the RPi. And I have the root CA from the RP…

macOS uses certificate pinning for some .apple.com and .itunes.com sites. If you pass all your traffic through the proxy, some stuff like the app store will not work. Do you bypass the proxy for those or just let them fail?

I do that on purpose. I don’t want macOS itself to reach the internet. Only Firefox, brew, etc

Re: Running one’s own root Certificate Authority in 2023

#36

Post by dmayle »

obnauticus wrote: post #24

I eventually need to publish an article about how to run an HSM backed root CA on the cheap with m of n auth. Using nitrokey and some glue scripts you can get the cost below $500. If anyone is interested, let me know.

I've just started down that route. I've got the nitro key hsm2 in the mail, have heard the advice on using two levels (first root in the Key, and intermediary on the Device for easier revoking). I mainly want to issue client certificates so that I can expose internal sites on the public Internet via proxy without having to require a VPN for all of my users, though I'm also interested in certificate based SSH

Re: Running one’s own root Certificate Authority in 2023

#38

Post by andrewstuart2 »

I've done similar for something like 8 years with vault as my intermediate issuer, almost exclusively using cert-manager once that was mature enough, and my own little utility before that. It's so nice getting certs for side projects or self hosting in an instant and with an encrypted (pgp) offline (flash drive in a safe) CA I'm never really worried about having to reroll. Installing the CA is pretty trivial on most devices and means I don't have to worry about CTLs or rate limits, which is especially helpful when I'm hacking on a saas side project that ends up requesting 10+ certificates every test run.

Re: Running one’s own root Certificate Authority in 2023

#39

Post by petronio »

mirchiseth wrote: post #8
NegativeK wrote: post #2

I went with DNS based Let's Encrypt for internal certificates, since I'm okay leaking my internal DNS names. > An obvious downside of this is having to guard a bunch of secrets and the need to rotate the host certificates yearly – because Apple says so. The guarding secrets thing makes me too uncomfortable with managing my own CA. I'm sure it'd be fine, but since there are other equivalent and safer ways to do it.. N…

I used to have my own local root CA as well but now trying the Let's Encrypt with DNS-01. What is the easiest combination of software to try it? I have failed miserably trying Opnsense + ACME client plugin + Cloudflare DNS + HAProxy / NGinx. I would get 100% ssllabs certs but somehow the reverse proxy won't forward to internal services. Next I am gonna go caddyserver for reverse proxy as it has SSL with LE inbuilt. L…

I've had a lot of success with https://github.com/dehydrated-io/dehydrated . It exposes the different parts of the process (deploy challenge to DNS, deploy cert to filesystem, etc) as hooks, so it's pretty easy to integrate with anything and however you want, if you don't mind writing a bit of bash. There's a few scripts out there that use Cloudflare that you can use as well.

Re: Running one’s own root Certificate Authority in 2023

#40

Post by sneak »

fiddlerwoaroof wrote: post #4
NegativeK wrote: post #2

I went with DNS based Let's Encrypt for internal certificates, since I'm okay leaking my internal DNS names. > An obvious downside of this is having to guard a bunch of secrets and the need to rotate the host certificates yearly – because Apple says so. The guarding secrets thing makes me too uncomfortable with managing my own CA. I'm sure it'd be fine, but since there are other equivalent and safer ways to do it.. N…

The one thing you can’t do with Let’s Encrypt is generate a certificate with a CN of localhost which, since browsers are getting really picky about mixed HTTP/HTTPS content, is a real issue with local development using certain web features.

Why not register a domain, get a cert for it, and point it at 127.0.0.1? Then nothing can complain.
Post reply on HN