5 ms·

We had a lengthy discussion today in the SignalK project (http://signalk.org/ http://signalk.org/) about exactly that. The best approach I've seen so far is th

We had a lengthy discussion today in the SignalK project (http://signalk.org/ http://signalk.org/) about exactly that. The best approach I've seen so far is the way Plex has done it: https://en.wikipedia.org/wiki/Plex_(software)#SSL https://en.wikipedia.org/wiki/Plex_(software)#SSL

prophesi 9y ago
Wow, that's an ingenious solution! It's such a shame that this requires jumping through so many hoops (and becoming a Registration Authority... Not sure how difficult or pricy that would be). And I never heard of Signal K. That is an awesome project, and definitely could benefit from end-to-end encryption for transporting marine data.
- emilecantin 9y ago
  Yeah, becoming a CA is kind of a PITA. I think a "Sub-domain CA" would be a kind of happy middle ground, as it wouldn't need to be trusted as much. Also, the Plex approach requires some DNS trickery, which works well when you're online, but on a boat in the middle of an ocean, it might be harder... We need a way to secure local-only communications, with local-only names (like .local). While we're at it, mDNS support in browsers would be nice, too.
  - lmm 9y ago
    The whole idea of HTTPS is that a given domain name has a single, globally-consistent meaning, that a user can trust that a given name will be the same thing anywhere. I don't think .local should be able to override that, that would be a large-scale phishing incident waiting to happen.
- lmm 9y ago
  Setting up an internal CA really isn't a lot of hoops - any nontrivial tech company does it, anyone running a Mumble or OpenVPN server does it. (I don't know about the requirements for having one signed by the public infrastructure though)
  - dalore 9y ago
    You still need to distribute the CA certs so they are trusted by various browsers. Which isn't a solution for the public.
    - lmm 9y ago
      You can have the end webserver serve the intermediate chain, no?
      - dalore 9y ago
        If you create your own CA it's not trusted by your browser. Intermediate chains have nothing to do with it because at the end of the chain is no trust.
        lmm 9y ago
        Plex became an intermediate CA, not a root CA, right? Or did I misunderstand?
        dalore 9y ago
        Small misunderstanding. The browsers have a list of CA's they trust. Let's call them the root CAs. You normally won't get a http cert signed by a root CA, it's normally done by an intermediate CA. Now your browser doesn't that, but it's been signed by a root CA so your browser eventually trusts it. You get your server to also serve the intermediate CA certs to save a round trip for requesting it. But in the end, because it's the chain of trust, your browser trusts it because it's eventually signed by a trusted root CA. Now if you create your own CA you will need to be installed in the users browsers to trust. Even if you put the intermediate certificates as your browser can't establish a link of trust.
        lmm 9y ago
        > Now if you create your own CA you will need to be installed in the users browsers to trust. Even if you put the intermediate certificates as your browser can't establish a link of trust. If you create your own root CA you will need to be installed in the user's browsers to trust. If you create your own intermediate CA then you only need for your CA's certificate to be signed by an existing root CA.

prophesi 9y ago

Wow, that's an ingenious solution! It's such a shame that this requires jumping through so many hoops (and becoming a Registration Authority... Not sure how difficult or pricy that would be). And I never heard of Signal K. That is an awesome project, and definitely could benefit from end-to-end encryption for transporting marine data.

emilecantin 9y ago
Yeah, becoming a CA is kind of a PITA. I think a "Sub-domain CA" would be a kind of happy middle ground, as it wouldn't need to be trusted as much. Also, the Plex approach requires some DNS trickery, which works well when you're online, but on a boat in the middle of an ocean, it might be harder... We need a way to secure local-only communications, with local-only names (like .local). While we're at it, mDNS support in browsers would be nice, too.
- lmm 9y ago
  The whole idea of HTTPS is that a given domain name has a single, globally-consistent meaning, that a user can trust that a given name will be the same thing anywhere. I don't think .local should be able to override that, that would be a large-scale phishing incident waiting to happen.
lmm 9y ago
Setting up an internal CA really isn't a lot of hoops - any nontrivial tech company does it, anyone running a Mumble or OpenVPN server does it. (I don't know about the requirements for having one signed by the public infrastructure though)
- dalore 9y ago
  You still need to distribute the CA certs so they are trusted by various browsers. Which isn't a solution for the public.
  - lmm 9y ago
    You can have the end webserver serve the intermediate chain, no?
    - dalore 9y ago
      If you create your own CA it's not trusted by your browser. Intermediate chains have nothing to do with it because at the end of the chain is no trust.
      - lmm 9y ago
        Plex became an intermediate CA, not a root CA, right? Or did I misunderstand?
        dalore 9y ago
        Small misunderstanding. The browsers have a list of CA's they trust. Let's call them the root CAs. You normally won't get a http cert signed by a root CA, it's normally done by an intermediate CA. Now your browser doesn't that, but it's been signed by a root CA so your browser eventually trusts it. You get your server to also serve the intermediate CA certs to save a round trip for requesting it. But in the end, because it's the chain of trust, your browser trusts it because it's eventually signed by a trusted root CA. Now if you create your own CA you will need to be installed in the users browsers to trust. Even if you put the intermediate certificates as your browser can't establish a link of trust.
        lmm 9y ago
        > Now if you create your own CA you will need to be installed in the users browsers to trust. Even if you put the intermediate certificates as your browser can't establish a link of trust. If you create your own root CA you will need to be installed in the user's browsers to trust. If you create your own intermediate CA then you only need for your CA's certificate to be signed by an existing root CA.