4 ms·

Good ideas are rarely unique, as they usually solve a common problem. I recently built something similar: https://github.com/FiloSottile/mkcert https://github.

Good ideas are rarely unique, as they usually solve a common problem. I recently built something similar: https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert It's in pure Go instead of using OpenSSL, and it works with Windows, macOS and Firefox, too.

andy_ppp 8y ago
Fascinating that Golang reimplemented all the crypto/ssl/tls in Golang itself rather than linking to a C library. I'd probably trust the Go code (a safer language) over OpenSSL so that's a pretty interesting use case.
- beatgammit 8y ago
  Why? Surely OpenSSL has a bigger team auditing the codebase, especially recently since they've gotten so much attention for previous security failures. Also, Go's TLS library is missing some important features, like decrypting most varieties of private keys. I use Go's TLS library, but I don't think it's necessary "better" than openssl, though it's certainly more convenient.
  - andy_ppp 8y ago
    I'm making no definitive statements just more interested that they did it. I would personally trust a new Go codebase over an old C codebase but I could definitely be wrong in this case.
shroom 8y ago
Thanks for creating such a easy to use tool for solving an annoying "problem" with local certs. I never really tried to solve this myself so I just "put up" with the browser warning. I managed to add a key following the README on your repo with no problems what so ever on MacOSX. :)
kingkool68 8y ago
Yours is a much more robust solution that I wish I had found before writing my own. But at least I got a better understanding with how all of this stuff works. I've added a link to your project in my README.md file.
kakwa_ 8y ago
Personally, I tend to use the easy-rsa set of scripts https://github.com/OpenVPN/easy-rsa https://github.com/OpenVPN/easy-rsa. Initially they used to come as a goodies with OpenVPN, but they are now provided as a standalone project. There are already packaged and available in most distributions (easy-rsa package under Debian for example). There are probably a little bit more complex to use, but it's far from horrible, and it's quite battle tested.

andy_ppp 8y ago

Fascinating that Golang reimplemented all the crypto/ssl/tls in Golang itself rather than linking to a C library. I'd probably trust the Go code (a safer language) over OpenSSL so that's a pretty interesting use case.

beatgammit 8y ago
Why? Surely OpenSSL has a bigger team auditing the codebase, especially recently since they've gotten so much attention for previous security failures. Also, Go's TLS library is missing some important features, like decrypting most varieties of private keys. I use Go's TLS library, but I don't think it's necessary "better" than openssl, though it's certainly more convenient.
- andy_ppp 8y ago
  I'm making no definitive statements just more interested that they did it. I would personally trust a new Go codebase over an old C codebase but I could definitely be wrong in this case.

shroom 8y ago

Thanks for creating such a easy to use tool for solving an annoying "problem" with local certs. I never really tried to solve this myself so I just "put up" with the browser warning. I managed to add a key following the README on your repo with no problems what so ever on MacOSX. :)

kingkool68 8y ago

Yours is a much more robust solution that I wish I had found before writing my own. But at least I got a better understanding with how all of this stuff works. I've added a link to your project in my README.md file.

kakwa_ 8y ago

Personally, I tend to use the easy-rsa set of scripts https://github.com/OpenVPN/easy-rsa https://github.com/OpenVPN/easy-rsa. Initially they used to come as a goodies with OpenVPN, but they are now provided as a standalone project. There are already packaged and available in most distributions (easy-rsa package under Debian for example). There are probably a little bit more complex to use, but it's far from horrible, and it's quite battle tested.