3 ms·
So what is the Neosmart solution? If I can request an SSL cert for a private IP address, how does the CA verify it? Even if they do verify it, what prevents me
by DKnoll 9y ago
So what is the Neosmart solution?
If I can request an SSL cert for a private IP address, how does the CA verify it? Even if they do verify it, what prevents me from using it for malicious purposes on other networks (MITM https://192.168.0.1 https://192.168.0.1 with a valid cert or similar)?
For enterprises you can run your own CA, push out the trusted root with Group Policy (or equivalent), so it's not a issue there.
IoT vendors should definitely use HTTPS, but document how to generate a self-signed cert (or generate a request) from their own proprietary interface and how to install it. This would fix the problem.
- scarhill 9y agoNot the author, but I think the proposal would be for browsers to not display scary warning pages HTTPS requests using self-signed certificates where the hostname is an RFC1918 IP address. The argument is that self-signed certificates on internal-only IPs aren't any less secure than plain HTTP.
- DKnoll 9y ago>Not the author, but I think the proposal would be for browsers to not display scary warning pages HTTPS requests using self-signed certificates where the hostname is an RFC1918 IP address. In this case he makes no reference to hostnames, but short hostnames (not fully qualified) are a similar case. I believe they should still display a warning, but perhaps adjust the wording. SSL certs are not just useful for validation (domain validation, exstended validation) but also for fingerprinting. Self-signed certs are not a security risk provided you confirm it has the expected fingerprint and/or install it so it appears in browser as validated.
- captn3m0 9y agoChrome already has a flag to allow self signed cert when accessing localhost.