7 ms·

If you wonder how to get HTTPS for your local virtual hosts: 1. create a local CA 2. create a certificate using that local CA 3. Then you can add the CA in y

If you wonder how to get HTTPS for your local virtual hosts: 1. create a local CA 2. create a certificate using that local CA 3. Then you can add the CA in your trusted authorities (Firefox does need an extra step: either enable the "security.enterprise_roots.enabled" flag, either import the CA certificate manually in it). Details at: https://gist.github.com/cecilemuller/9492b848eb8fe46d462abeb26656c4f8 https://gist.github.com/cecilemuller/9492b848eb8fe46d462abeb...

LeoPanthera 8y ago
I found this script to manage your local CA: https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert
- compuguy 8y ago
  You can also use the good old EASY-RSA: https://github.com/OpenVPN/easy-rsa https://github.com/OpenVPN/easy-rsa
  - Spivak 8y ago
    Don't get me wrong, using easy-rsa is definitely easier than not but it doesn't abstract nearly as much as a tool for local development probably should which mkcert definitely provides.
meta_AU 8y ago
The other option is to register a domain and use that to get either LetsEncrypt cetts or purchase a wildcard.
- xienze 8y ago
  That’s what I do. And LE actually supports wildcards, so that’s no problem. If your local network is firewalled off LE can still issue you a cert so long as you use DNS record validation.
  - meta_AU 8y ago
    It depends how often you want to update things I guess. A wildcard costs less than $50 a year these days, so if that might be better for some people than renewing their LE every few months.
    - tialaramex 8y ago
      I almost sympathize but 1. Maximum cert lifetimes are falling, once upon a time you'd just pony up the cash and get five years. A year ago it was 36 months, for a few months now it's been 825 days, and there is downward pressure. So you are still going to need to renew this cert, and that means... 2. You can and should automate. Imagine buying a device in 2018 that expects you to manually input an IP address because "Eh, we could do DHCP but this was less effort (for us)". That'd be crazy right? Time to feel the same way about certificate automation.
      - tbyehl 8y ago
        Between Certs and Java, it's the older IPMI devices that really kill me. I have some that don't even allow for custom certs and none support that type of automation that I'm aware of. In theory these problems go away over time but most of my home servers are in the cost vs. performance-per-watt sweet spot and won't be replaced for many years.
Buetol 8y ago
Let’s push for self-signed certicates everywhere ! Let’s do Trust On First Use like SSH and now we’re done with all this certificates authorities bloated bureaucraties
- rileymat2 8y ago
  But how am I supposed to know if I can trust it if it is the first time I am using it?
  - Karunamon 8y ago
    Some kind of cert observatory tool that checks if the cert you're getting matches the cert everyone else is getting.
    - core-questions 8y ago
      If only there was some kind of distributed ledger thing we could use to make sure everyone had the same information as everyone else using cryptography
      - colemickens 8y ago
        My understanding is that Certificate Transparency (https://www.certificate-transparency.org/ https://www.certificate-transparency.org/) is pretty much that. "Certificate Transparency helps eliminate these flaws by providing an open framework for monitoring and auditing SSL certificates in nearly real time. Specifically, Certificate Transparency makes it possible to detect SSL certificates that have been mistakenly issued by a certificate authority or maliciously acquired from an otherwise unimpeachable certificate authority. It also makes it possible to identify certificate authorities that have gone rogue and are maliciously issuing certificates." "Certificate Transparency logs use a special cryptographic mechanism to facilitate public auditing of certificates and logs. This special cryptographic mechanism, known as a Merkle hash tree, is a simple binary tree consisting of hashed leaves and nodes (see figure 1)."
  - 8y ago
tvmalsv 8y ago
Thank you! This, along with my sibling replies, is some great information. Nothing that most of us couldn't accomplish without it, but it's going to save a lot of time. Multiplied by all the others that find it useful (I can't be the only one, right?), you have saved a LOT of time :)
echevil 8y ago
I'd expect Chrome to provide some settings at least to not mark local IPs as not secure

LeoPanthera 8y ago

I found this script to manage your local CA: https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert

compuguy 8y ago
You can also use the good old EASY-RSA: https://github.com/OpenVPN/easy-rsa https://github.com/OpenVPN/easy-rsa
- Spivak 8y ago
  Don't get me wrong, using easy-rsa is definitely easier than not but it doesn't abstract nearly as much as a tool for local development probably should which mkcert definitely provides.

meta_AU 8y ago

The other option is to register a domain and use that to get either LetsEncrypt cetts or purchase a wildcard.

xienze 8y ago
That’s what I do. And LE actually supports wildcards, so that’s no problem. If your local network is firewalled off LE can still issue you a cert so long as you use DNS record validation.
- meta_AU 8y ago
  It depends how often you want to update things I guess. A wildcard costs less than $50 a year these days, so if that might be better for some people than renewing their LE every few months.
  - tialaramex 8y ago
    I almost sympathize but 1. Maximum cert lifetimes are falling, once upon a time you'd just pony up the cash and get five years. A year ago it was 36 months, for a few months now it's been 825 days, and there is downward pressure. So you are still going to need to renew this cert, and that means... 2. You can and should automate. Imagine buying a device in 2018 that expects you to manually input an IP address because "Eh, we could do DHCP but this was less effort (for us)". That'd be crazy right? Time to feel the same way about certificate automation.
    - tbyehl 8y ago
      Between Certs and Java, it's the older IPMI devices that really kill me. I have some that don't even allow for custom certs and none support that type of automation that I'm aware of. In theory these problems go away over time but most of my home servers are in the cost vs. performance-per-watt sweet spot and won't be replaced for many years.

Buetol 8y ago

Let’s push for self-signed certicates everywhere ! Let’s do Trust On First Use like SSH and now we’re done with all this certificates authorities bloated bureaucraties

rileymat2 8y ago
But how am I supposed to know if I can trust it if it is the first time I am using it?
- Karunamon 8y ago
  Some kind of cert observatory tool that checks if the cert you're getting matches the cert everyone else is getting.
  - core-questions 8y ago
    If only there was some kind of distributed ledger thing we could use to make sure everyone had the same information as everyone else using cryptography
    - colemickens 8y ago
      My understanding is that Certificate Transparency (https://www.certificate-transparency.org/ https://www.certificate-transparency.org/) is pretty much that. "Certificate Transparency helps eliminate these flaws by providing an open framework for monitoring and auditing SSL certificates in nearly real time. Specifically, Certificate Transparency makes it possible to detect SSL certificates that have been mistakenly issued by a certificate authority or maliciously acquired from an otherwise unimpeachable certificate authority. It also makes it possible to identify certificate authorities that have gone rogue and are maliciously issuing certificates." "Certificate Transparency logs use a special cryptographic mechanism to facilitate public auditing of certificates and logs. This special cryptographic mechanism, known as a Merkle hash tree, is a simple binary tree consisting of hashed leaves and nodes (see figure 1)."
- 8y ago

tvmalsv 8y ago

Thank you! This, along with my sibling replies, is some great information. Nothing that most of us couldn't accomplish without it, but it's going to save a lot of time. Multiplied by all the others that find it useful (I can't be the only one, right?), you have saved a LOT of time :)

echevil 8y ago

I'd expect Chrome to provide some settings at least to not mark local IPs as not secure