3 ms·

I actually need to do this. Is there a best practice for handling the certificate? It needs to be installed on the machine for the browser to trust it. All I ca

I actually need to do this. Is there a best practice for handling the certificate? It needs to be installed on the machine for the browser to trust it. All I can think of is to make a new certificate for every machine at install time and binding an obscure domain name to the loopback interface, so it would be highly unlikely to overlap with a real site.

ploxiln 9y ago
You can do what Cisco did with the domain name. Just don't create a CA-trusted cert for it. Instead, as you suppose, generate a unique cert on each machine and install it to the appropriate/needed trust stores on that machine.
justinclift 9y ago
The Plex approach, pointed out above by diafygi above might suit you. https://news.ycombinator.com/item?id=14595269 You need a wildcard cert (not hard), and a DNS resolver (daemon) to respond back with custom IP address. Sounds pretty simple in concept. :)
- pilif 9y ago
  A wildcard won’t help much. If you want to do this correctly, then each client needs to generate a unique certificate and private key. The name in the certificate, the custom resolver helps with, but now you’re stuck with that uniquely generated certificate which you now need signed by a CA. And this is the step that’s problematic: that host is not connectable from the outside, so there’s no way for, say, let’s encrypt to do http validation (even if their usage quota would allow to do this at scale, which it doesn’t), so you’d have to do domain validation which would work, but would require your clients to ship their private keys to the server which is a big nono again. You could also do some crazy polling approach in order to have your server relay between the DNS validation by let’s encrypt and your client (which, again, usually is behind a NAT and firewall, so it has to poll the server to have the possibility to send the response to the ACME challenge), but this is a huge amount of work, and, again, doesn’t work because of per-domain quotas. So now you’re stuck with a custom solution with a CA which involves you having a trusted signed CA certificate (good luck getting that one) and providing these clients with an API or having a CA providing a custom API for these clients to use. None of these things are widely available and as they are custom solutions, I’m sure CAs will require a lot of money for, provided they even talk to you at all if you are a small company.
  - euroclydon 9y ago
    On Windows, I would just put the certificate in the trusted root at install time. No need to use a CA. That's what Fiddler does. It seems safe, since the certificate is one-off per machine, and never leaves the machine.
    - pilif 9y ago
      As it's a local installation, it will be blocked by user's limited permissions, by locally installed security products and by paranoid users regularly culling their certificates (believe me, been there, done that). It also won’t work if the user is using Firefox or any other solution that works outside of the OS certificate store. Messing with a Firefox profile is frowned upon by Mozilla and even if you did that, it still doesn’t solve the problem for other things that bypass the OS certificate store.
  - vbezhenar 9y ago
    You could use DNS validation method for letsencrypt. But letsencrypt have pretty strict limits, so it won't work for a lot of users without their special permission.

ploxiln 9y ago

You can do what Cisco did with the domain name. Just don't create a CA-trusted cert for it. Instead, as you suppose, generate a unique cert on each machine and install it to the appropriate/needed trust stores on that machine.

justinclift 9y ago

The Plex approach, pointed out above by diafygi above might suit you. https://news.ycombinator.com/item?id=14595269 You need a wildcard cert (not hard), and a DNS resolver (daemon) to respond back with custom IP address. Sounds pretty simple in concept. :)

pilif 9y ago
A wildcard won’t help much. If you want to do this correctly, then each client needs to generate a unique certificate and private key. The name in the certificate, the custom resolver helps with, but now you’re stuck with that uniquely generated certificate which you now need signed by a CA. And this is the step that’s problematic: that host is not connectable from the outside, so there’s no way for, say, let’s encrypt to do http validation (even if their usage quota would allow to do this at scale, which it doesn’t), so you’d have to do domain validation which would work, but would require your clients to ship their private keys to the server which is a big nono again. You could also do some crazy polling approach in order to have your server relay between the DNS validation by let’s encrypt and your client (which, again, usually is behind a NAT and firewall, so it has to poll the server to have the possibility to send the response to the ACME challenge), but this is a huge amount of work, and, again, doesn’t work because of per-domain quotas. So now you’re stuck with a custom solution with a CA which involves you having a trusted signed CA certificate (good luck getting that one) and providing these clients with an API or having a CA providing a custom API for these clients to use. None of these things are widely available and as they are custom solutions, I’m sure CAs will require a lot of money for, provided they even talk to you at all if you are a small company.
- euroclydon 9y ago
  On Windows, I would just put the certificate in the trusted root at install time. No need to use a CA. That's what Fiddler does. It seems safe, since the certificate is one-off per machine, and never leaves the machine.
  - pilif 9y ago
    As it's a local installation, it will be blocked by user's limited permissions, by locally installed security products and by paranoid users regularly culling their certificates (believe me, been there, done that). It also won’t work if the user is using Firefox or any other solution that works outside of the OS certificate store. Messing with a Firefox profile is frowned upon by Mozilla and even if you did that, it still doesn’t solve the problem for other things that bypass the OS certificate store.
- vbezhenar 9y ago
  You could use DNS validation method for letsencrypt. But letsencrypt have pretty strict limits, so it won't work for a lot of users without their special permission.