4 ms·
> Parent comment was talking about routers and network printers. No CA (except for if you're your own CA) would provision a certificate for "192.168.0.1" or "hp
by y0ghur7_xxx 8y ago
> Parent comment was talking about routers and network printers. No CA (except for if you're your own CA) would provision a certificate for "192.168.0.1" or "hp-laserjet".
hp could get a cert for 15327c5ba80d1b8933.hp.com and make it resolve to 192.168.0.5 (your printer).
- colejohnson66 8y agoBut then what about when the printer’s IP address changes because it’s dynamic?
- dspillett 8y agoddns? Or use addresses like https://192-168-1-1.hp.net https://192-168-1-1.hp.net (https://192-168-43-123.hp.net https://192-168-43-123.hp.net, https://10-20-30-40.hp.net https://10-20-30-40.hp.net, and so on) and a wildcard cert. No harder to document than telling people to go to http://192.168.1.1 http://192.168.1.1. Though they should be more careful than to use to top-level domain as they need to include the private key in the device unless they have the devices call out to have a new certificate generated, perhaps 192-168-1-1.internaldevices.hp.net and so forth.
- nsgi 8y agoIt would be necessary to use a different private key on each device for it to be secure, so something like 192-168-1-1.internaldevices1489420.hp.net
- fulafel 8y agoDNS got fixed to handle dynamic updates in the early 2000's.
- stephengillie 8y agoWhat if someone else uses 192.168.0.5 for their printer too? This just seems incredibly insecure, where I'll have to keep a public record of the private addresses of my devices. Welcome to the Fishbowl.
- fulafel 8y agoYes, RFC1918 addresses are ambiguous, and generally they have this problem, independent of using DNS. You should use IPv6 if you can. But now you are running TLS, so the address conflict would just yield a cert error. (If the other guy plugged his network or printer into yours, that is)
- stephengillie 8y agoYes, I'm running TLS behind my NAT, where unsecured traffic should be safe. Or should we be using VPN tunnels within our private networks? And at the same time, I've introduced an internet connection dependency and a 3rd party dependency. What happens when they decide to stop updating that cert, to save money?
- fulafel 8y agoYou shouldn't treat a SOHO or home network, NAT or not, as secure. There are good reasons why we don't trust the network. Getting compromised is not an "if", it's a "when".