5 ms·

Are you saying that you can't create a self-signed CA that Chrome will trust when configured to do so? Personally, I'm using Letsencrypt with DNS validation fo

Are you saying that you can't create a self-signed CA that Chrome will trust when configured to do so? Personally, I'm using Letsencrypt with DNS validation for internal projects. A wildcard certificate that needs to be renewed every 3 months for a domain does the trick, the servers themselves don't need to be on the Internet, just have a domain-based name. (I have some Ansible automation behind it.)

born2discover 3y ago
That sounds intriguing, could you please elaborate?
- janosd 3y ago
  I assume you are interested in the Letsencrypt part. Basically, I'm running an Ansible script on my computer, which creates an account key, the server key and requests a certificate. The server key and the certificate are then distributed to the servers that need them, leaving the original account key only on my machine. The Letsencrypt verification happens via my DNS provider, which happens to have an Ansible module. Here's the source code: [link redacted]
jjkeddo199 3y ago
Is there a way to do this for default Chrome installs? The whole point of hosting something for LAN is so family members can use the site on a whim from their iphone.
- janosdebugs 3y ago
  AFAIK Chrome uses the OS certificate store, so you should just need to provision your CA in the OS itself. For iPhones you may be able to use configuration profiles, which are also useful if you want to set up stuff like email accounts, etc. However, it's been a while since I made on of those, so I don't know if you can use it for certificates. You may have better luck with Letsencrypt instead.
  - Scion9066 3y ago
    You can use it for certificates, it just looks like there's an extra step to say that you really trust it as a root: https://support.apple.com/en-us/HT204477 https://support.apple.com/en-us/HT204477
    - jkaplowitz 3y ago
      That extra step is only required when you deploy the certificates through one of the less secure methods: > You must manually turn on trust for SSL/TLS when you install a profile that is sent to you via email or downloaded from a website. The more secure deployment methods do not require this: > Apple recommends deploying certificates via Apple Configurator or Mobile Device Management (MDM). Certificate payloads are automatically trusted for SSL when installed with Configurator, MDM, or as part of an MDM enrollment profile. Both of these quotes are from the link you provided.
      - Scion9066 3y ago
        I figured most people looking to do this at home wouldn't have a home MDM solution to deploy it with. You're right though that it could probably be done with Apple Configurator fairly easily.
unshavedyak 3y ago
I’m planning and in process of doing the same. I am trying to figure out how to easily automate it, though. Pork bun offers automatic ssl, but I’m not sure how that works. My servers would still all need to download a PEM or w/e right? So while support for that sort of feature is neat, I still need to automate pulling the certs. May as well just do it directly from LetsEncrypt and modify the DNS .. maybe. I dunno, still exploring.
- janosdebugs 3y ago
  Yes, you need a way to distribute the certificate PEM to your servers. The key PEM you have to generate yourself. However, nothing mandates that the server using it needs to have direct internet access, see my explanation here: https://news.ycombinator.com/item?id=37153485 https://news.ycombinator.com/item?id=37153485
NegativeK 3y ago
I consider managing a CA at home to be a _much_ bigger security risk than having HTTP traffic on my home LAN.
- ownagefool 3y ago
  This doesn't make sense unless you use the CA for something in addition / more critical for HTTP. Sure, you could leak said CA, but it's only going to leave you in the same position as HTTP.
  - NegativeK 3y ago
    You can generate CA certs that are only allowed to sign certs for specific domains, but _nothing_ respects that self limitation. That means that if the CA keys get out, someone could use it to sign their own cert for google.com, [mybank].com, or [mypasswordmanager].com. Every device with my CA cert on it will trust those.
    - ownagefool 3y ago
      That's a fair point.
- janosdebugs 3y ago
  That may be so, but I from the perspective of a few billion people using Chrome, the percentage of people that need to and should access something on the local network without encryption is probably a few magnitudes smaller than the same audience on Hacker News.
- GoblinSlayer 3y ago
  Sign a certificate expiring in 2070 and delete the CA key. That's all management you need. And if anyone has access to your disk, it's much easier for them to add you their CA certificate than search for your CA key.
xg15 3y ago
Yes, that would work. It still sucks that if I want a browser on my LAN to talk with a server on the same LAN, I now somehow still need internet access (to renew the cert), need at least two accounts on 3rd part cloud services (the domain registrar and Let's Encrypt) and have to continuously pay for the domain. Oh, and also have to mess around with the DNS configuration on the router, so the domain is correctly resolved to your LAN IP inside the network, but does not have A/AAAA records on the internet. Also, this solves this problem for geeks with some knowledge of network protocols, but it still leaves everyone stranded who would like to run a local server but has no deep technical knowledge. Finally, it's impossible to solve this problem in a large-scale manner, i.e. for devices you want to sell. Which is why the access menus for home routers will probably still stay on plaintext HTTP.
- insanitybit 3y ago
  I don't think you need to pay for a domain, nor do you need internet access to renew the certificate. You could either just have the cert point to an IP, or you could have the domain resolve to something at the router level/ configure our DNS however you like so that it resolves to the other device. Or you can just disable the strict HTTPS settings, which this post addresses? > We know that enterprises and education networks have unique needs. These features can be turned on early, customized, or turned off entirely via the HttpsOnlyMode, HttpsUpgradesEnabled, HttpAllowlist, and InsecureContentAllowedForUrls policies.
  - xg15 3y ago
    > I don't think you need to pay for a domain, nor do you need internet access to renew the certificate. You could either just have the cert point to an IP, or you could have the domain resolve to something at the router level/ configure our DNS however you like so that it resolves to the other device. If I use a custom root CA, I don't need a domain. However, then my local server will only be accessible on devices where I can install the custom CA, i.e. usually, my own devices only. If I want the server accessible to other people, I need a cert from a real CA - and those are basically forbidden from granting certs for 192.168.* IPs or really anything that is not a properly registered internet domain: https://www.globalsign.com/en/blog/certificates-for-internal-servers https://www.globalsign.com/en/blog/certificates-for-internal... > Or you can just disable the strict HTTPS settings, which this post addresses? That as well works for my own device, but not for devices of other people.
Arcanum-XIII 3y ago
I can. My ex can't. My parents can't. My ex's parents either can. Strangely enough, normal people can't. And that's the issue.
- janosdebugs 3y ago
  And what services do these people need to access/run on the local network that can't possibly be encrypted? The average person shouldn't be doing any of these things.
  - Volundr 3y ago
    My home router for example always throws up a big scary https warning. I'd also very much prefer it if more smart devices were local network only rather than relying on a vendors website being up in perpetuity. I'm actually not against browsers pushing HTTPS, I'm all for it. But it is a fair criticism that there are real downsides that there currently isn't a good user friendly solution for.
    - aaomidi 3y ago
      Use Caddy as your webserver, use the DNS01 challenge, and you're done? Don't expose your local stuff over the internet without encryption. The ISP doesn't need to see that.
      - deleted 3y ago
        [deleted]
      - kalleboo 3y ago
        How is your home internet router going to retrieve a certificate from Let's Encrypt before you have logged in and configured it to connect to the internet?
        aaomidi 3y ago
        Your preloaded root chain? I mean you can also trust on first use if you really want to.

born2discover 3y ago

That sounds intriguing, could you please elaborate?

janosd 3y ago
I assume you are interested in the Letsencrypt part. Basically, I'm running an Ansible script on my computer, which creates an account key, the server key and requests a certificate. The server key and the certificate are then distributed to the servers that need them, leaving the original account key only on my machine. The Letsencrypt verification happens via my DNS provider, which happens to have an Ansible module. Here's the source code: [link redacted]

jjkeddo199 3y ago

Is there a way to do this for default Chrome installs? The whole point of hosting something for LAN is so family members can use the site on a whim from their iphone.

janosdebugs 3y ago
AFAIK Chrome uses the OS certificate store, so you should just need to provision your CA in the OS itself. For iPhones you may be able to use configuration profiles, which are also useful if you want to set up stuff like email accounts, etc. However, it's been a while since I made on of those, so I don't know if you can use it for certificates. You may have better luck with Letsencrypt instead.
- Scion9066 3y ago
  You can use it for certificates, it just looks like there's an extra step to say that you really trust it as a root: https://support.apple.com/en-us/HT204477 https://support.apple.com/en-us/HT204477
  - jkaplowitz 3y ago
    That extra step is only required when you deploy the certificates through one of the less secure methods: > You must manually turn on trust for SSL/TLS when you install a profile that is sent to you via email or downloaded from a website. The more secure deployment methods do not require this: > Apple recommends deploying certificates via Apple Configurator or Mobile Device Management (MDM). Certificate payloads are automatically trusted for SSL when installed with Configurator, MDM, or as part of an MDM enrollment profile. Both of these quotes are from the link you provided.
    - Scion9066 3y ago
      I figured most people looking to do this at home wouldn't have a home MDM solution to deploy it with. You're right though that it could probably be done with Apple Configurator fairly easily.

unshavedyak 3y ago

I’m planning and in process of doing the same. I am trying to figure out how to easily automate it, though. Pork bun offers automatic ssl, but I’m not sure how that works. My servers would still all need to download a PEM or w/e right? So while support for that sort of feature is neat, I still need to automate pulling the certs. May as well just do it directly from LetsEncrypt and modify the DNS .. maybe. I dunno, still exploring.

janosdebugs 3y ago
Yes, you need a way to distribute the certificate PEM to your servers. The key PEM you have to generate yourself. However, nothing mandates that the server using it needs to have direct internet access, see my explanation here: https://news.ycombinator.com/item?id=37153485 https://news.ycombinator.com/item?id=37153485

NegativeK 3y ago

I consider managing a CA at home to be a _much_ bigger security risk than having HTTP traffic on my home LAN.

ownagefool 3y ago
This doesn't make sense unless you use the CA for something in addition / more critical for HTTP. Sure, you could leak said CA, but it's only going to leave you in the same position as HTTP.
- NegativeK 3y ago
  You can generate CA certs that are only allowed to sign certs for specific domains, but _nothing_ respects that self limitation. That means that if the CA keys get out, someone could use it to sign their own cert for google.com, [mybank].com, or [mypasswordmanager].com. Every device with my CA cert on it will trust those.
  - ownagefool 3y ago
    That's a fair point.
janosdebugs 3y ago
That may be so, but I from the perspective of a few billion people using Chrome, the percentage of people that need to and should access something on the local network without encryption is probably a few magnitudes smaller than the same audience on Hacker News.
GoblinSlayer 3y ago
Sign a certificate expiring in 2070 and delete the CA key. That's all management you need. And if anyone has access to your disk, it's much easier for them to add you their CA certificate than search for your CA key.

xg15 3y ago

Yes, that would work. It still sucks that if I want a browser on my LAN to talk with a server on the same LAN, I now somehow still need internet access (to renew the cert), need at least two accounts on 3rd part cloud services (the domain registrar and Let's Encrypt) and have to continuously pay for the domain. Oh, and also have to mess around with the DNS configuration on the router, so the domain is correctly resolved to your LAN IP inside the network, but does not have A/AAAA records on the internet. Also, this solves this problem for geeks with some knowledge of network protocols, but it still leaves everyone stranded who would like to run a local server but has no deep technical knowledge. Finally, it's impossible to solve this problem in a large-scale manner, i.e. for devices you want to sell. Which is why the access menus for home routers will probably still stay on plaintext HTTP.

insanitybit 3y ago
I don't think you need to pay for a domain, nor do you need internet access to renew the certificate. You could either just have the cert point to an IP, or you could have the domain resolve to something at the router level/ configure our DNS however you like so that it resolves to the other device. Or you can just disable the strict HTTPS settings, which this post addresses? > We know that enterprises and education networks have unique needs. These features can be turned on early, customized, or turned off entirely via the HttpsOnlyMode, HttpsUpgradesEnabled, HttpAllowlist, and InsecureContentAllowedForUrls policies.
- xg15 3y ago
  > I don't think you need to pay for a domain, nor do you need internet access to renew the certificate. You could either just have the cert point to an IP, or you could have the domain resolve to something at the router level/ configure our DNS however you like so that it resolves to the other device. If I use a custom root CA, I don't need a domain. However, then my local server will only be accessible on devices where I can install the custom CA, i.e. usually, my own devices only. If I want the server accessible to other people, I need a cert from a real CA - and those are basically forbidden from granting certs for 192.168.* IPs or really anything that is not a properly registered internet domain: https://www.globalsign.com/en/blog/certificates-for-internal-servers https://www.globalsign.com/en/blog/certificates-for-internal... > Or you can just disable the strict HTTPS settings, which this post addresses? That as well works for my own device, but not for devices of other people.

Arcanum-XIII 3y ago

I can. My ex can't. My parents can't. My ex's parents either can. Strangely enough, normal people can't. And that's the issue.

janosdebugs 3y ago
And what services do these people need to access/run on the local network that can't possibly be encrypted? The average person shouldn't be doing any of these things.
- Volundr 3y ago
  My home router for example always throws up a big scary https warning. I'd also very much prefer it if more smart devices were local network only rather than relying on a vendors website being up in perpetuity. I'm actually not against browsers pushing HTTPS, I'm all for it. But it is a fair criticism that there are real downsides that there currently isn't a good user friendly solution for.
  - aaomidi 3y ago
    Use Caddy as your webserver, use the DNS01 challenge, and you're done? Don't expose your local stuff over the internet without encryption. The ISP doesn't need to see that.
    - deleted 3y ago
      [deleted]
    - kalleboo 3y ago
      How is your home internet router going to retrieve a certificate from Let's Encrypt before you have logged in and configured it to connect to the internet?
      - aaomidi 3y ago
        Your preloaded root chain? I mean you can also trust on first use if you really want to.