3 ms·
Im not able to use SSL certs on all my endpoints. I have to use self-signed certs. That's because many of my machines are on TOR hidden services. The CA-CERT w
by kefka 11y ago
Im not able to use SSL certs on all my endpoints. I have to use self-signed certs. That's because many of my machines are on TOR hidden services.
The CA-CERT won't allow any certs for .onion unless you buy at exorbitant price an EV2 cert. And that especially means no free certs.
So I do use self-signed because I want end to end crypto (and the next-to node can see data). Of course my browsers throw a fit, but alas I am indeed secure.
... but I want an .onion cert authority by LetsEncrypt and first-class network routing for all .onion addresses in Linux via /etc/resolve.conf
- Integer 11y agoI always thought .onion sites are end to end encrypted. "The rendezvous point simply relays (end-to-end encrypted) messages from client to service and vice versa." according to https://www.torproject.org/docs/hidden-services.html.en https://www.torproject.org/docs/hidden-services.html.en There's even a ticket to add a padlock to indicate this in TOR Browser https://trac.torproject.org/projects/tor/ticket/8686 https://trac.torproject.org/projects/tor/ticket/8686
- IceyEC 11y agoThis is correct, hidden services are fully encrypted from the users browser to the tor relay running the hidden service
- kefka 11y agoMy understanding was that the connection prior saw the cleartext of the final destination's packets. SSL was the way to make sure that end to end was encrypted so that nobody could read the data (mainly login/password info). I think the only way to see is to be part of the tunnel architecture and see if my thoughts are right or wrong.
- pfg 11y agoWhat you're saying is correct for connections from tor to cleartext sites. Hidden services are end-to-end encrypted. I'm not sure which cipher tor uses; maybe modern browsers are better in that respect.