Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Running one’s own root Certificate Authority in 2023

wejn.org

Post reply on HN
Print view View original

101–110 of 164 posts

Re: Running one’s own root Certificate Authority in 2023

#101

Post by withinboredom »

galaxyLogic wrote: post #89

I'm building an app whose GUI runs in the browser talking to a local http server. The app (if and when it is ready) would be distributed as a standalone executable. A bit like Atom/Electron I guess. What I haven't figured out yet is how the browser-GUI could talk to its local backend-server over https. Can an exe contain its own root-certificate-authority somehow in a way that the app-exe can work without having to u…

Dear god why? People using ports (even on ::1) is super annoying when it collides with development. Hunting down the offender is not always straightforward and introduces a new failure mode for you (when I’m already using that port for something else). Also, it opens the door for literally any other software (or xss attacks) to connect and issue api calls you may not expect.

Just create a native app. Use something like C# MAUI or whatever language you’re familiar with. Your users will thank you for a smooth experience.

Re: Running one’s own root Certificate Authority in 2023

#102

Post by cpach »

mirchiseth wrote: post #8
NegativeK wrote: post #2

I went with DNS based Let's Encrypt for internal certificates, since I'm okay leaking my internal DNS names. > An obvious downside of this is having to guard a bunch of secrets and the need to rotate the host certificates yearly – because Apple says so. The guarding secrets thing makes me too uncomfortable with managing my own CA. I'm sure it'd be fine, but since there are other equivalent and safer ways to do it.. N…

I used to have my own local root CA as well but now trying the Let's Encrypt with DNS-01. What is the easiest combination of software to try it? I have failed miserably trying Opnsense + ACME client plugin + Cloudflare DNS + HAProxy / NGinx. I would get 100% ssllabs certs but somehow the reverse proxy won't forward to internal services. Next I am gonna go caddyserver for reverse proxy as it has SSL with LE inbuilt. L…

This ACME client looks promising, but I haven’t tried it yet: https://github.com/go-acme/lego

Re: Running one’s own root Certificate Authority in 2023

#103

Post by cpach »

xg15 wrote: post #34
fiddlerwoaroof wrote: post #32

Earlier quoted context omitted.

I have a dashboard I run via nginx on localhost that makes a bunch of requests to various https endpoints. It definitely doesn’t just work unless you have a trusted SSL certificate and run localhost as HTTPS

Huh, that's odd. Gonna test this as well then.

I think it’s the mixing of HTTP and HTTPS that most browsers doesn’t like.

If you develop locally and it’s only HTTP with no HTTPS, then I think it works.

Re: Running one’s own root Certificate Authority in 2023

#104

Post by hnarn »

NegativeK wrote: post #2

I went with DNS based Let's Encrypt for internal certificates, since I'm okay leaking my internal DNS names. > An obvious downside of this is having to guard a bunch of secrets and the need to rotate the host certificates yearly – because Apple says so. The guarding secrets thing makes me too uncomfortable with managing my own CA. I'm sure it'd be fine, but since there are other equivalent and safer ways to do it.. N…

> I went with DNS based Let's Encrypt for internal certificates, since I'm okay leaking my internal DNS names.

Lets Encrypt offers wildcard certificates, there is no reason to have internal DNS records exposed.

Re: Running one’s own root Certificate Authority in 2023

#105

Post by jimmyspice »

withinboredom wrote: post #101
galaxyLogic wrote: post #89

I'm building an app whose GUI runs in the browser talking to a local http server. The app (if and when it is ready) would be distributed as a standalone executable. A bit like Atom/Electron I guess. What I haven't figured out yet is how the browser-GUI could talk to its local backend-server over https. Can an exe contain its own root-certificate-authority somehow in a way that the app-exe can work without having to u…

Dear god why? People using ports (even on ::1) is super annoying when it collides with development. Hunting down the offender is not always straightforward and introduces a new failure mode for you (when I’m already using that port for something else). Also, it opens the door for literally any other software (or xss attacks) to connect and issue api calls you may not expect. Just create a native app. Use something li…

what's wrong with using a dynamically allocated port?

Re: Running one’s own root Certificate Authority in 2023

#106

Post by remram »

goku12 wrote: post #95
remram wrote: post #84

I tend to treat service TLS certificates more like shared keys than PKI. Too many pieces of software don't handle revocation, it's easier to regenerate the CA and the entire set of certificates when you change your setup.

The better solution is to do what vault does. Use only ephemeral certificates for servers and clients. It wouldn't be too hard to change them every week or so using the ACME protocol.

ACME has a revocation workflow. Having my lost certificates be valid for a week is still unacceptable.

Re: Running one’s own root Certificate Authority in 2023

#107

Post by wejn »

NegativeK wrote: post #2

I went with DNS based Let's Encrypt for internal certificates, since I'm okay leaking my internal DNS names. > An obvious downside of this is having to guard a bunch of secrets and the need to rotate the host certificates yearly – because Apple says so. The guarding secrets thing makes me too uncomfortable with managing my own CA. I'm sure it'd be fine, but since there are other equivalent and safer ways to do it.. N…

Thanks, I've incorporated the name constraints into the article now. (it is indeed supported by Apple and FF just fine)

Re: Running one’s own root Certificate Authority in 2023

#109

Post by jiggawatts »

mdekkers wrote: post #76
jiggawatts wrote: post #62

Earlier quoted context omitted.

The key phrase here is internal use . Think authentication between two micro services, not HTTPS for someblog.com. The third party in this case is just a file: the internal CA key. Try to think of this in the following terms: the issued certs are just signed tokens , nothing more. They’re also conveniently a public-private key pair, but that’s not the point. The point is that if you used a 1kb random password for ser…

> The point is that if you used a 1kb random password for service to service auth and someone tried to sell you a $400/mo service to generate them, you’d laugh in their face and then have security escort them from the building. Go ahead, run an internal secret store that issues properly trustworthy internal certificates. It isn’t hard, but neither is it cheap not. You oversimplify and gloss over a few _really_ import…

Internal here means I don’t need the certificates trusted by a third party.

Having built many Enterprise PKI systems — including Smart Card auth — I do know the complexity involved. I can prattle on for hours about how the Key Recovery Agents should be distributed and stored, and how “offline” means no network cables at all you dimwit.

I also know that there is virtually no difference between a root CA certificate and a signed leaf certificate.

They’re both just files.

The difference is the amount of ceremony.

DigiCert’s Root CA certificate files had a lot of ceremony — with good reason.

But the CA for “I need five devs in India to get VPN certs with a common root” is practically zero.

No, it does not take a “a lot of infrastructure” to host a 1kb file. It really doesn’t, and your persistent confusion is my point: you are simply unable to let go of your preconceptions.

Just last week I needed a pair of certs with a common root for a load balancer’s back end. Not for transmitting NSA secrets over intercontinental backhaul.

I already have access to a bone-fide HSM! For pennies!

Why can’t I be allowed to use that pre-engineered secure certificate storage system for its intended purpose!?

Re: Running one’s own root Certificate Authority in 2023

#110

Post by rad_gruchalski »

jiggawatts wrote: post #66
matthewaveryusa wrote: post #63

Earlier quoted context omitted.

PKI can provide non-repudiation while signed tokens and API keys cannot. There's a big difference transmitting a bearer token vs establishing a TLS connection.

I get that you don't get it... that's my point. A public-private key pair is clever cryptography, yes, but INTERNALLY within a network they're not Magic(tm) that requires a multi-billion dollar market cap company to issue with some Indian call centre verifying my identity papers. The same cryptographic algorithm has two wildly different uses: one that is $0.0000001 in value, and one that requires a third party organi…

> People conflate the two and then try to charge $50 for the $0.0000001 use-case

Then… don’t buy certificates? Use letsencrypt or run your own CA? There are tons of options out there.

Post reply on HN