5 ms·

Plex does this by generating a private key at install then issuing a real ssl cert for it. That way the private key never is seen by Plex or anyone else. Really

Plex does this by generating a private key at install then issuing a real ssl cert for it. That way the private key never is seen by Plex or anyone else. Really cool technique. https://blog.filippo.io/how-plex-is-doing-https-for-all-its-users/ https://blog.filippo.io/how-plex-is-doing-https-for-all-its-...

pilif 9y ago
Yes. But it requires them to have a CA certificate which requires special contracts with a CA. Now, Cisco could certainly do that, but for smaller companies, that‘s probably not feasible
- koenrh 9y ago
  Not necessarily. Plex does not hold the private key for their intermediate certificate authority ('Plex Devices High Assurance CA2'). They use a DigiCert API to sign certificates under the 'plex.direct' domain.
  - pilif 9y ago
    Which means: special deal with digicert. Or can you link me to a product page where anybody can sign up?
    - Azeralthefallen 9y ago
      A company i used to work for tried to get something similar to what Digicert has with Plex, and the initial cost was very high.
    - hannob 9y ago
      Let's Encrypt. There's no reason not to use LE. You need to make sure that your device is accessible under the given subdomain for a certain period, and it may not always be trivial. But there are ways to do that.
      - pilif 9y ago
        Let’s encrypt has tight limits on the amount of certificates it issues per domain. Presumably to stop this exact scheme
        detaro 9y ago
        You might qualify for the Public Suffix List (https://publicsuffix.org/list/ https://publicsuffix.org/list/), which also helps browsers isolate your subdomains, and Let's Encrypt has a trial program for organizations that need more than 2000 subdomains: https://docs.google.com/forms/d/e/1FAIpQLSfg56b_wLmUN7n-WWhbwReE11YoHXs_fpJyZcEjDaR69Q-kJQ/viewform?c=0&w=1 https://docs.google.com/forms/d/e/1FAIpQLSfg56b_wLmUN7n-WWhb...
      - derf_ 9y ago
        > You need to make sure that your device is accessible under the given subdomain for a certain period, and it may not always be trivial. I tried to set up Let's Encrypt for this purpose for a personal project (to be given away as a gift), and concluded it was basically impossible as things are. You don't want your users to have to figure out how to open their firewall enough for an http server to be publicly reachable just to use your device, especially when it has no other need for it. It would need to be reachable every 60-90 days to renew the certificates, which is frequently enough to mean "always". The ACME protocol does have a DNS-based challenge mechanism, but it requires putting a token in a TXT record at an administrative sub-domain of your actual domain (e.g., _acme_challenge.example.com). As far as I can tell, none of the free DNS providers support or enable this (nor does certbot, without writing your own hooks). I don't want to eat a domain registration fee in perpetuity for a gift. Sadly, there's no ACME challenge that can be satisfied solely by the actual thing you're trying to assert, which is that you control which IP address a given domain name points to.
        lgats 9y ago
        Cloudflare might work for this.
Azeralthefallen 9y ago
The company i used to work for wanted to basically replicate what plex does with their certs for our IoT devices. Unfortunately the price implied by Digicert was far too high for a startup. The other solutions proposed like abusing Lets Encrypt, etc never really seemed right. I am still not sure really what the best solution is for IoT devices that doesn't have an astronomical cost.
- vbezhenar 9y ago
  I can see three solutions. 1. Use HTTP. It's not forbidden yet. I think it's the most compatible solution. 2. Use http://127.0.0.1 http://127.0.0.1. It seems that this is standards-compatible solution, but browser support is not good enough, so if you can dictate browser choice for your user, it's the best future-proof solution. 3. Use your server as a proxy. When your localhost application wants to talk to your site, it talks to server and server retransmits this data to the browser. Quite cumbersome solution IMO, but should work, unless you must be able to work offline.

pilif 9y ago

Yes. But it requires them to have a CA certificate which requires special contracts with a CA. Now, Cisco could certainly do that, but for smaller companies, that‘s probably not feasible

koenrh 9y ago
Not necessarily. Plex does not hold the private key for their intermediate certificate authority ('Plex Devices High Assurance CA2'). They use a DigiCert API to sign certificates under the 'plex.direct' domain.
- pilif 9y ago
  Which means: special deal with digicert. Or can you link me to a product page where anybody can sign up?
  - Azeralthefallen 9y ago
    A company i used to work for tried to get something similar to what Digicert has with Plex, and the initial cost was very high.
  - hannob 9y ago
    Let's Encrypt. There's no reason not to use LE. You need to make sure that your device is accessible under the given subdomain for a certain period, and it may not always be trivial. But there are ways to do that.
    - pilif 9y ago
      Let’s encrypt has tight limits on the amount of certificates it issues per domain. Presumably to stop this exact scheme
      - detaro 9y ago
        You might qualify for the Public Suffix List (https://publicsuffix.org/list/ https://publicsuffix.org/list/), which also helps browsers isolate your subdomains, and Let's Encrypt has a trial program for organizations that need more than 2000 subdomains: https://docs.google.com/forms/d/e/1FAIpQLSfg56b_wLmUN7n-WWhbwReE11YoHXs_fpJyZcEjDaR69Q-kJQ/viewform?c=0&w=1 https://docs.google.com/forms/d/e/1FAIpQLSfg56b_wLmUN7n-WWhb...
    - derf_ 9y ago
      > You need to make sure that your device is accessible under the given subdomain for a certain period, and it may not always be trivial. I tried to set up Let's Encrypt for this purpose for a personal project (to be given away as a gift), and concluded it was basically impossible as things are. You don't want your users to have to figure out how to open their firewall enough for an http server to be publicly reachable just to use your device, especially when it has no other need for it. It would need to be reachable every 60-90 days to renew the certificates, which is frequently enough to mean "always". The ACME protocol does have a DNS-based challenge mechanism, but it requires putting a token in a TXT record at an administrative sub-domain of your actual domain (e.g., _acme_challenge.example.com). As far as I can tell, none of the free DNS providers support or enable this (nor does certbot, without writing your own hooks). I don't want to eat a domain registration fee in perpetuity for a gift. Sadly, there's no ACME challenge that can be satisfied solely by the actual thing you're trying to assert, which is that you control which IP address a given domain name points to.
      - lgats 9y ago
        Cloudflare might work for this.

Azeralthefallen 9y ago

The company i used to work for wanted to basically replicate what plex does with their certs for our IoT devices. Unfortunately the price implied by Digicert was far too high for a startup. The other solutions proposed like abusing Lets Encrypt, etc never really seemed right. I am still not sure really what the best solution is for IoT devices that doesn't have an astronomical cost.

vbezhenar 9y ago
I can see three solutions. 1. Use HTTP. It's not forbidden yet. I think it's the most compatible solution. 2. Use http://127.0.0.1 http://127.0.0.1. It seems that this is standards-compatible solution, but browser support is not good enough, so if you can dictate browser choice for your user, it's the best future-proof solution. 3. Use your server as a proxy. When your localhost application wants to talk to your site, it talks to server and server retransmits this data to the browser. Quite cumbersome solution IMO, but should work, unless you must be able to work offline.