3 ms·
You can get somewhat close to that with getlocalcert. When the device first boots, it calls the getlocalcert API to register a free, anonymous domain name (nega
by 8organicbits 3y ago
You can get somewhat close to that with getlocalcert. When the device first boots, it calls the getlocalcert API to register a free, anonymous domain name (negative: its a UUID domain, ugly). You'd need outbound connections to api.getlocalcert.net and an ACME certificate authority (Let's Encrypt) to issue a ccertificate. When the user connects to http://<ip-address> http://<ip-address> it redirects to https://<uuid>.localcert.net https://<uuid>.localcert.net, which the browser trusts since the cert is from a public CA. No need to manually trust a cert. The user would bookmark it and all future use is HTTPS-only.
If I see usage like this, there's ways I can make this cleaner.
- denton-scratch 3y ago> it calls the getlocalcert API to register a free, anonymous domain name ...rather than to get an actual certificate. I didn't dig past the front page, but as far as I can see, they don't issue HTTPS certs at all, easy or oherwise; they offer managed DNS subdomains. You want a cert, you have to get it somewhere else.
- 8organicbits 3y agoAs a security engineer I'm wary of tools that offer to issue certificates for you. You've got to trust that they won't keep a copy of your private key. ACME clients [1] generate keys on your device, which is the recommended way. But you're right. Issuing Let's Encrypt certificates on behalf of users could simplify the process even more. [1] https://docs.getlocalcert.net/acme-clients/#setting-txt-records https://docs.getlocalcert.net/acme-clients/#setting-txt-reco...