2 ms·

What bootstraps all of the steps that talk to this service? DHCP + wpc_url in DHCP options? How would the IoT and the browser know about this service and make

What bootstraps all of the steps that talk to this service? DHCP + wpc_url in DHCP options? How would the IoT and the browser know about this service and make use of it? If it's manual steps, then the self hosted ACME service should suffice. If you need the IoT and browser to just figure this out, then all IoT's and browsers would need some form of service discovery. ssdp, dhcp+wpad_url, etc... or captive portal perhaps for wifi. Even then we are talking about amendments to RFC's and getting everyone to adopt this.

JulianMorrison 6y ago
I'm presuming there's some standard way to discover this service, like it's on a standard broadcast address. Yes, it would need to be supported by browsers.
- LinuxBender 6y ago
  some standard way Browsers and IoT today have no standard way to do this today aside from corporate managed workstations like active directory policies. The mechanisms could include broadcast packets like ssdp, or DHCP options with some mangled use of wpad_url, but the browsers and IoT today don't have such a mechanism for certs. So it will be on you or a team you build to write the RFC's for this, create standard client libraries that can be used in IoT and browsers, then get everyone to adopt them. Maybe a smaller baby-step would be to see if there is a way to write the client as a browser addon. Assuming this is even possible with the sandboxing of addons today, if it became popular enough, maybe browser vendors would uptake your code as a standard function in the browser. IoT manufacturers are all over the board on standards and seldom agree on one thing. Maybe you could start with high end enterprise IoT devices that live on corporate networks. Some generic IoT devices today work around this by just accepting any cert but you can't predict what devices will do this.

JulianMorrison 6y ago

I'm presuming there's some standard way to discover this service, like it's on a standard broadcast address. Yes, it would need to be supported by browsers.

LinuxBender 6y ago
some standard way Browsers and IoT today have no standard way to do this today aside from corporate managed workstations like active directory policies. The mechanisms could include broadcast packets like ssdp, or DHCP options with some mangled use of wpad_url, but the browsers and IoT today don't have such a mechanism for certs. So it will be on you or a team you build to write the RFC's for this, create standard client libraries that can be used in IoT and browsers, then get everyone to adopt them. Maybe a smaller baby-step would be to see if there is a way to write the client as a browser addon. Assuming this is even possible with the sandboxing of addons today, if it became popular enough, maybe browser vendors would uptake your code as a standard function in the browser. IoT manufacturers are all over the board on standards and seldom agree on one thing. Maybe you could start with high end enterprise IoT devices that live on corporate networks. Some generic IoT devices today work around this by just accepting any cert but you can't predict what devices will do this.