Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mkcert: Tool for making locally-trusted development certificates

github.com

Post reply on HN
Print view View original

31–40 of 41 posts

Re: Mkcert: Tool for making locally-trusted development certificates

#31

Post by ausjke »

ausjke wrote: post #26

for embedded boxes golang is either unsupported there, or its binary is typical over-sized, a bash or C version of the same functionalities will be great there. then you can have letsencrypt easily these days so probably we can use 'official certificate' even for local development these days?

i am always puzzled by some of those down-votes, i thought constructive thoughts are at least welcomed at HN. The fact is at HN unless you are saying "this is a great idea/project and you're awesome" or be totally neutral, any other thoughts such as a constructive one, not to mention a critical one, will always or at least very likely to get a down-vote.

it's pathetic, grow up, listen to both sides, technical discussion has its merits, embrace it.

if you're only looking to "this is great" comments at HN, there is no point being here at all.

Yes, some of you will down-vote this, to make your day.

Re: Mkcert: Tool for making locally-trusted development certificates

#32

Post by kodablah »

nailer wrote: post #13
vectorEQ wrote: post #7

Earlier quoted context omitted.

you would need node js installed, so that's atleast 1 installation requirement... node.js has as one of it's dependencies openSSL. So you could use openssl commands and have actually less installation requirements.

Still sounds good to me - it would do extra stuff like adding it to the Windows cert store if you're there, adding it to Firefox if you use it, etc. And being package it's better to collaborate on than everyone making their own process (and possibly screwing it up). Since many people who run https://localhost are doing front end development node will probably already be there.

> it would do extra stuff like adding it to the Windows cert store if you're there, adding it to Firefox if you use it, etc

This is what mkcert does (FF on Windows not done yet, but FF everywhere else and OS root store is).

> And being package it's better to collaborate on than everyone making their own process (and possibly screwing it up)

Not sure the difference between it being an npm package or a Go project on GitHub is that large. Or are you saying "go build" is easier to screw up than "npm install"?

EDIT: My mistake, misunderstood the context of the comment.

Re: Mkcert: Tool for making locally-trusted development certificates

#33

Post by deathanatos »

hagreet wrote: post #22
nohawp wrote: post #18

Earlier quoted context omitted.

Does not support localhost...

Excuses.

It's not really an "excuse"; a normal CA is not — cannot — going to sign a certificate for "localhost"; it wouldn't make any sense, and the verification methods that prevent any random joe from getting a cert for "google.com" wouldn't even work against localhost, or when you're pretending to be a domain you aren't (obviously!). (E.g., "example.com" in the article.)

The only way to use a real CA such as Let's Encrypt here would be to actually have a domain name. While I do have my own, I'm not going to us that at work. While my work has a domain, of course, we manage it with Route53, and AWS doesn't support delegating control over a subtree in DNS via IAM — that is, it's not possible to restrict permissions on a domain s.t. I could have a subtree to myself. (I've complained/feature requested this to AWS, but their responses have been less than enthusiastic.) Aside from not having a domain, I don't have an IP at work, as we're on an IPv4-only network and connection.

While none of this makes it impossible to use LE, it requires effort from people that aren't me. Tools like the one in the link fill a real need.

Re: Mkcert: Tool for making locally-trusted development certificates

#34

Post by FiloSottile »

tialaramex wrote: post #21

(All the below assumes I can read 'Go') Nit picks about these certificates: The certificates have a lifetime of 10 years starting from the exact moment they're created. I suspect ten years is overkill, but I don't see much real harm in it. However it's common practice to set the notBefore into the recent past, this is because a variety of problems may cause clock drift. This is your development environment, so you _c…

Hi! Author here.

I was backdating, but I realized a correct notBefore helps identifying when and why you made the certificate. I removed the backdating at the same time as I added the host name in the OU. Nobody has complained so far, so probably not a real problem on dev environments.

I would kind of hope that for client auth you’d have support for a custom root instead of the system pool, hence not needing mkcert (in its current form). But if someone actually finds themselves needing that I’d accept a PR.

Key Usage has been screwed up so much than nearly no one checks them, but in any case I don’t feel like this is the place to fight the RSA key exchange.

Re: Mkcert: Tool for making locally-trusted development certificates

#35

Post by nailer »

kodablah wrote: post #32
nailer wrote: post #13

Earlier quoted context omitted.

Still sounds good to me - it would do extra stuff like adding it to the Windows cert store if you're there, adding it to Firefox if you use it, etc. And being package it's better to collaborate on than everyone making their own process (and possibly screwing it up). Since many people who run https://localhost are doing front end development node will probably already be there.

> it would do extra stuff like adding it to the Windows cert store if you're there, adding it to Firefox if you use it, etc This is what mkcert does (FF on Windows not done yet, but FF everywhere else and OS root store is). > And being package it's better to collaborate on than everyone making their own process (and possibly screwing it up) Not sure the difference between it being an npm package or a Go project on Gi…

> This is what mkcert does

> Not sure the difference between it being an npm package or a Go project on GitHub is that large.

I know mkcert also does this. I also agree that other maintained projects are good too. My comment was in response was to it's parent, which reads:

> So you could use openssl commands and have actually less installation requirements.

Re: Mkcert: Tool for making locally-trusted development certificates

#36

Post by FiloSottile »

Hello HN, author here! :)

Something I would love to collect some feedback on is: how would mkcert have to change, if at all, to support a production CA (for stuff like internal machines talking to each other)? Should it even try, or does a tool like minica do the trick there?

And please open an issue if it doesn’t just work on your dev machine!

Re: Mkcert: Tool for making locally-trusted development certificates

#37

Post by nailer »

Improvotter wrote: post #14
nailer wrote: post #12

No installation required: https://certsimple.com/blog/localhost-ssl-fix A few clicks and 1 actual command on macOS

The point of mkcert is so you can use it on any OS without a bunch of hoops to jump through.

Installation of a binary is also a hoop.

Re: Mkcert: Tool for making locally-trusted development certificates

#38

Post by nailer »

nickcox wrote: post #15
nailer wrote: post #13

Earlier quoted context omitted.

Still sounds good to me - it would do extra stuff like adding it to the Windows cert store if you're there, adding it to Firefox if you use it, etc. And being package it's better to collaborate on than everyone making their own process (and possibly screwing it up). Since many people who run https://localhost are doing front end development node will probably already be there.

If you're on Windows then you get creating a certificate and adding it to the cert store out of the box with PowerShell[0]. [0] https://docs.microsoft.com/en-us/powershell/module/pkiclient...

That's really useful - and worth submitting as a separate post.

Re: Mkcert: Tool for making locally-trusted development certificates

#39

Post by lysium »

ausjke wrote: post #31
ausjke wrote: post #26

for embedded boxes golang is either unsupported there, or its binary is typical over-sized, a bash or C version of the same functionalities will be great there. then you can have letsencrypt easily these days so probably we can use 'official certificate' even for local development these days?

i am always puzzled by some of those down-votes, i thought constructive thoughts are at least welcomed at HN. The fact is at HN unless you are saying "this is a great idea/project and you're awesome" or be totally neutral, any other thoughts such as a constructive one, not to mention a critical one, will always or at least very likely to get a down-vote. it's pathetic, grow up, listen to both sides, technical discuss…

It was not constructive. And let’s encrypt does not work for localhost.

Re: Mkcert: Tool for making locally-trusted development certificates

#40

Post by epcim »

ausjke wrote: post #25
beardicus wrote: post #11

I've had good luck with caman ( https://github.com/radiac/caman ), but it doesn't do any of the fancy certificate installation bits. This looks neat and useful.

bash-based, looks good to me.

cfssl shell wrapper https://github.com/epcim/cfssl-pki
Post reply on HN