4 ms·

I have tried to do just that but ran into all kinds of difficulties: 1. Overhead: I have 5 devices that I own 3 of my wife and a smart TV. Setting all this us

I have tried to do just that but ran into all kinds of difficulties: 1. Overhead: I have 5 devices that I own 3 of my wife and a smart TV. Setting all this us takes a lot of time, even if it worked fine. 2. What about visitors to my home, that I want to give access? They need the cert as well together with lengthy instructions on how to install it. 3. How do I even install certs on an iPhone? 4. Firefox uses it's own Certificate Database -- for each profile. So I'll have to install certs on the system AND on the host (for e.g. Chrome to find it). 5. All these steps need to be repeated every year (90 days?!) depending on the cert expiration period. Eventually I just gave up on this. It's not practical. There needs to be a better solution.

spockz 6y ago
I have been looking at using MDM for my iPhone so I can install trusted root certs and require it to be on vpn when not using a specific list of WiFi networks. It is a hassle and as far as I could see it requires resetting the device and I’m not sure I can restore my backup over it and retain both.
zaarn 6y ago
If you keep your CA secure, no reason that you can't set the expiration of the root cert to something like 10 years.
- tsimionescu 6y ago
  Will browsers accept that?
  - zaarn 6y ago
    Browsers accept a root CA with long lifetime. Certs signed by CAs installed by the user or admin also allow long lifetimes (probably will still for a while).
isignal 6y ago
https://news.ycombinator.com/item?id=17748208 https://news.ycombinator.com/item?id=17748208 I found the steps described in https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert reasonable to follow. It describes an iOS workflow too.
greggman3 6y ago
I am as upset as you about this and cancelled IoT related projects because of it But, #3 How do I even install certs on an iPhone AFAIK (though I've never done it) you use a configuration profile https://developer.apple.com/documentation/devicemanagement/configuring_multiple_devices_using_profiles https://developer.apple.com/documentation/devicemanagement/c... https://support.apple.com/guide/deployment-reference-ios/certificate-deployment-apd1145c7251/web https://support.apple.com/guide/deployment-reference-ios/cer...
katbyte 6y ago
15$ a year for a domain, throw traffic through local [split?] dns and traefik with the lets encrypt dns challenge and call it a day? i have over 25 internal domains & services with 25 certs auto renewing and no one can tell - it just works and is easier the self signing certs and loading them into whatever rando service or device your trying to secure
- midasuni 6y ago
  Split dns is dying - doh is sorting that. Sure canary domains exist, but they won’t forever
  - katbyte 6y ago
    i'm not sure i follow, what does split DNS have to do with DoH? i don't want my internal DNS addresses public, there is no need + security and for some addresses i have different IPs internal vs external.
    - midasuni 6y ago
      Browsers send to external provider like google, rather than the network provided server which has the internal addresses (and which may override external addresses for various reasons)
      - katbyte 6y ago
        split-dns will never die, it would kill far to many internal corp environments where there is no public DNS entries.
rblatz 6y ago
I bought a domain For use on my local network. I use letsencrypt for free certs, and I have multiple sub domains hosted under it. It works very well and wasn’t that hard to setup. It’s actually better organized and easier to use than my old system since I had to take the extra step up front to organize it under a domain.

spockz 6y ago

I have been looking at using MDM for my iPhone so I can install trusted root certs and require it to be on vpn when not using a specific list of WiFi networks. It is a hassle and as far as I could see it requires resetting the device and I’m not sure I can restore my backup over it and retain both.

zaarn 6y ago

If you keep your CA secure, no reason that you can't set the expiration of the root cert to something like 10 years.

tsimionescu 6y ago
Will browsers accept that?
- zaarn 6y ago
  Browsers accept a root CA with long lifetime. Certs signed by CAs installed by the user or admin also allow long lifetimes (probably will still for a while).

isignal 6y ago

https://news.ycombinator.com/item?id=17748208 https://news.ycombinator.com/item?id=17748208 I found the steps described in https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert reasonable to follow. It describes an iOS workflow too.

greggman3 6y ago

I am as upset as you about this and cancelled IoT related projects because of it But, #3 How do I even install certs on an iPhone AFAIK (though I've never done it) you use a configuration profile https://developer.apple.com/documentation/devicemanagement/configuring_multiple_devices_using_profiles https://developer.apple.com/documentation/devicemanagement/c... https://support.apple.com/guide/deployment-reference-ios/certificate-deployment-apd1145c7251/web https://support.apple.com/guide/deployment-reference-ios/cer...

katbyte 6y ago

15$ a year for a domain, throw traffic through local [split?] dns and traefik with the lets encrypt dns challenge and call it a day? i have over 25 internal domains & services with 25 certs auto renewing and no one can tell - it just works and is easier the self signing certs and loading them into whatever rando service or device your trying to secure

midasuni 6y ago
Split dns is dying - doh is sorting that. Sure canary domains exist, but they won’t forever
- katbyte 6y ago
  i'm not sure i follow, what does split DNS have to do with DoH? i don't want my internal DNS addresses public, there is no need + security and for some addresses i have different IPs internal vs external.
  - midasuni 6y ago
    Browsers send to external provider like google, rather than the network provided server which has the internal addresses (and which may override external addresses for various reasons)
    - katbyte 6y ago
      split-dns will never die, it would kill far to many internal corp environments where there is no public DNS entries.

rblatz 6y ago

I bought a domain For use on my local network. I use letsencrypt for free certs, and I have multiple sub domains hosted under it. It works very well and wasn’t that hard to setup. It’s actually better organized and easier to use than my old system since I had to take the extra step up front to organize it under a domain.