How to set up stress-free SSL on an OS X development machine • Hacker News Board

Re: How to set up stress-free SSL on an OS X development machine

#21

Post by bensummers » Wed, Dec 24, 2014, 10:58 AM UTC

I use multicast DNS so that my server in a development VM can automatically publish a hostname to the host for testing.

http://bens.me.uk/2013/multicast-dns-and-development-virtual...

This is especially useful as my application is multi-tenant, where you can potentially use lots of different hostnames.

I'm wary of trusting a development certificate on my development machines. One slight misconfiguration, and you've got a CA with a well-known private key which can be used to generate certificates for any name. Which would be very useful for MITMing a rather important machine.

I accept the inconvenience of having to click through the warnings, with conscious awareness of what I'm doing to avoid training myself to ignore them. I'm not entirely sure which is the bigger risk.

Re: How to set up stress-free SSL on an OS X development machine

#22

Post by pbreit » Thu, Dec 25, 2014, 5:23 AM UTC

philfreo wrote: post #4

pbreit wrote: post #3

I didn't see self-signed certs as an alternative. Isn't that a common and reasonable approach?

This describes setting up a self-signed cert

Oops! I read the 3 alternatives and didn't see self-signed certs, which seemed sorta obvious to me. Then skimmed a bit further and saw all sorts of other things and not really any specific mention of self-signed certs. My bad.

Re: How to set up stress-free SSL on an OS X development machine

#23

Post by junkblocker » Sat, Dec 27, 2014, 1:33 AM UTC

tbyehl wrote: post #16

iancarroll wrote: post #5

Keychain Access makes creating a certificate authority very easy - you might as well just use that... Besides, I don't understand why you would choose not to trust the certificate, then click it and choose to trust it...

For the non-OS X crowd, XCA is a really simple GUI for managing your own CA. Just about everything I have that can use an SSL certificate has one that all of my machines trust. http://xca.sourceforge.net/

Also, xca works just fine on OS X too.