3 ms·
Your solution generates a certificate and leaves it up to the user to setup https. There are other steps involved, like adding the cert to the trust store (so
by shivekkhurana 8y ago
Your solution generates a certificate and leaves it up to the user to setup https.
There are other steps involved, like adding the cert to the trust store (so you don't get invalid SSL warnings). And also changing your application code to use these certificates.
Even if you do that, you are still exposed to a serious security threat: if a bad actor gets hold of your certificate file, they can pose as a legitimate website and steal sensitive data. This security flaw is present with all other script solutions mentioned in this thread.
To overcome these issues, I have built a mac application called HTTPSLocalhost (https://httpslocalhost.com https://httpslocalhost.com).
- It offers a user interface to add remove local https domains
- Has an inbuilt proxy so you don't need to change your application code
- Is much safer because it deletes the certificate and private keys as soon as the proxy server starts
- It creates a new certificate each time you start the app, to enhance security.
- And of course, like all good things, is free (there is a video demo on the website, the app will be ready soon).
Wanted to do a proper Show HN next week, but I guess it's the right time to bring it up :)
Thanks
- Novashi 8y ago>Even if you do that, you are still exposed to a serious security threat: if a bad actor gets hold of your certificate file, they can pose as a legitimate website and steal sensitive data. This security flaw is present with all other script solutions mentioned in this thread. Sorry, but, what? Who is using self-signed certs for public production websites?
- shivekkhurana 8y agoNobody uses self-signed certs on prod. But if an attacker has a private key that is trusted by your local trust store, they can pose a legitimate website (man in the middle) and decrypt your traffic. The title tells me that this thread is about local https. Nothing to do with prod.
- Novashi 8y agoI thought there were varying amounts of trust with certificate stores? Local dev certs should go into a personal store or something that is less trusted than something like VeriSign. You shouldn't be able to mint a legit-looking Google certificates with the same private key that's only trusted via a local self-signed certificate. Maybe I don't understand something.
- gog 8y agoIf you have a Certificate Authority in your trust store, than any certificate signed by that CS is trusted by your system. That is why Google uses key pinning for their services and a list is hardcoded in Chrome, AFAIK.
- shivekkhurana 8y agoCouldn't mint absolutely legitimate certificates, but legitimate enough to fool the browser and the person who is browsing.