3 ms·

My project, getlocalcert.net[1] may be the one you're thinking of. Since I'm also building in this space, I'll give my perspective. Local certificate generatio

My project, getlocalcert.net[1] may be the one you're thinking of. Since I'm also building in this space, I'll give my perspective. Local certificate generation is complicated. If you spend the time, you can figure it out, but it's begging for a simpler solution. You can use tools like mkcert[2] for anything that's local to your machine. However, if you're already using ACME in production, maybe you'd prefer to use ACME locally? I think that's what Anchor offers, a unified approach. There's a couple references in the Anchor blog about solving the distribution problem by building better tooling[3]. I'm eager to learn more, that's a tough nut to crack. My theory for getlocalcert is that the distribution problem is too difficult (for me) to solve, so I layer the tool on top of Let's Encrypt certificates instead. The end result for both tools is a trusted TLS certificate issued via ACME automation. 1. https://news.ycombinator.com/item?id=36674224 https://news.ycombinator.com/item?id=36674224 2. https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert 3. https://blog.anchor.dev/the-acme-gap-introducing-anchor-part-1-of-3-2466ad7e53f6 https://blog.anchor.dev/the-acme-gap-introducing-anchor-part...

tuwtuwtuwtuw 3y ago
What is complicated about local certificate generation? You can generate one using openssl and then import it to cert store. That's a few minutes of work to create a script and to me seems much less complex than the alternatives of using some third party service. Reminds me of leftpad.
- 8organicbits 3y ago
  It depends a lot on what you are doing. The Caddy experience is great as it automates the whole process. But if you run Caddy in a docker container or a VM and connect from the host it's manual again. Maybe you've set up the Firefox trust store, but now Java apps can't connect. Your coworker wants to connect, and now your managing trust stores on other systems. If you need to write a script, then it's already too complex.
  - tuwtuwtuwtuw 3y ago
    Of course it will differ depending on scenario. Let's say I only want certs for local debugging and I use Java. I can create a script to generate such a cert and import in 5 minutes. Since it's for local debugging I don't care if cert is leaked so I can store it anywhere. Which solution is less complex? I followed OPs link to Anchor but was prompted to sign on using anorher third-party service which is already more complex in terms of rolling out in a medium sized team.
  - reactordev 3y ago
    “Your coworker wants to connect” It’s no longer local development now is it? You are crossing into dev deployment land. Unless you are talking about remote pair programming and setting up a reverse proxy at home to allow your coworker to connect or open some port forwards on your router (in which case, the world can connect). I’m in the camp that can write a 14 line Golang program that can generate a self-signed cert for whatever you want. Anything that needs a root CA is going to need LetsEncrypt or those god awful mafia-esque geotrust/verisign certs. The certs should be installed on your OS, not your browser. No trust stores to manage. Firefox will use Windows Certificate store, Mac keychain, Linux /etc/ssl/certs. For client certificates, you can generate a self-signed <dns-name-dejour> so long as your hosts file points the domain to your container IP or localhost. It’s not that complicated but it’s not trivial if you don’t understand certificates. Having a SaaS service do this for you I think is overkill. certbot could definitely do this. I think web frameworks should do this as part of their new-project process. Considering the world requires https.
    - 8organicbits 3y ago
      > It’s no longer local development now is it? I think that's part of the challenge. Your not "doing local development" or "doing dev deployment". Your trying to solve an evolving set of problems. A local CA works for local, but becomes a pain if you ever need something different.
benburkert 3y ago
> My theory for getlocalcert is that the distribution problem is too difficult (for me) to solve, so I layer the tool on top of Let's Encrypt certificates instead. The end result for both tools is a trusted TLS certificate issued via ACME automation. It's a really hard problem, and the root store programs do amazing work. The proof is that hardly anyone is even aware exist at all! I've also done the "use LE for internal TLS" setup, and it worked great until I hit API limits and everything came grinding to a halt. There's a few advantages to using Anchor as a drop in replacement for LE: - we use an EAB token ACME workflow, so no need to set DNS records or expose infra to the internet, just push API tokens to containers and provision certs at container boot. - EAB tokens are scoped to least privilege rules, so your staging tokens can't be used to provision production certs. - Certs don't show up in public certificate transparency logs.
rad_gruchalski 3y ago
> However, if you're already using ACME in production, maybe you'd prefer to use ACME locally? I just use Let’s Encrypt: https://gruchalski.com/posts/2021-06-04-letsencrypt-certificates-for-local-development/ https://gruchalski.com/posts/2021-06-04-letsencrypt-certific.... If I need a CA, I go for cfssl. Fact, I don’t have ACME via my own CA but it’s not necessary anyway if one is using LE.

tuwtuwtuwtuw 3y ago

What is complicated about local certificate generation? You can generate one using openssl and then import it to cert store. That's a few minutes of work to create a script and to me seems much less complex than the alternatives of using some third party service. Reminds me of leftpad.

8organicbits 3y ago
It depends a lot on what you are doing. The Caddy experience is great as it automates the whole process. But if you run Caddy in a docker container or a VM and connect from the host it's manual again. Maybe you've set up the Firefox trust store, but now Java apps can't connect. Your coworker wants to connect, and now your managing trust stores on other systems. If you need to write a script, then it's already too complex.
- tuwtuwtuwtuw 3y ago
  Of course it will differ depending on scenario. Let's say I only want certs for local debugging and I use Java. I can create a script to generate such a cert and import in 5 minutes. Since it's for local debugging I don't care if cert is leaked so I can store it anywhere. Which solution is less complex? I followed OPs link to Anchor but was prompted to sign on using anorher third-party service which is already more complex in terms of rolling out in a medium sized team.
- reactordev 3y ago
  “Your coworker wants to connect” It’s no longer local development now is it? You are crossing into dev deployment land. Unless you are talking about remote pair programming and setting up a reverse proxy at home to allow your coworker to connect or open some port forwards on your router (in which case, the world can connect). I’m in the camp that can write a 14 line Golang program that can generate a self-signed cert for whatever you want. Anything that needs a root CA is going to need LetsEncrypt or those god awful mafia-esque geotrust/verisign certs. The certs should be installed on your OS, not your browser. No trust stores to manage. Firefox will use Windows Certificate store, Mac keychain, Linux /etc/ssl/certs. For client certificates, you can generate a self-signed <dns-name-dejour> so long as your hosts file points the domain to your container IP or localhost. It’s not that complicated but it’s not trivial if you don’t understand certificates. Having a SaaS service do this for you I think is overkill. certbot could definitely do this. I think web frameworks should do this as part of their new-project process. Considering the world requires https.
  - 8organicbits 3y ago
    > It’s no longer local development now is it? I think that's part of the challenge. Your not "doing local development" or "doing dev deployment". Your trying to solve an evolving set of problems. A local CA works for local, but becomes a pain if you ever need something different.

benburkert 3y ago

> My theory for getlocalcert is that the distribution problem is too difficult (for me) to solve, so I layer the tool on top of Let's Encrypt certificates instead. The end result for both tools is a trusted TLS certificate issued via ACME automation. It's a really hard problem, and the root store programs do amazing work. The proof is that hardly anyone is even aware exist at all! I've also done the "use LE for internal TLS" setup, and it worked great until I hit API limits and everything came grinding to a halt. There's a few advantages to using Anchor as a drop in replacement for LE: - we use an EAB token ACME workflow, so no need to set DNS records or expose infra to the internet, just push API tokens to containers and provision certs at container boot. - EAB tokens are scoped to least privilege rules, so your staging tokens can't be used to provision production certs. - Certs don't show up in public certificate transparency logs.

rad_gruchalski 3y ago

> However, if you're already using ACME in production, maybe you'd prefer to use ACME locally? I just use Let’s Encrypt: https://gruchalski.com/posts/2021-06-04-letsencrypt-certificates-for-local-development/ https://gruchalski.com/posts/2021-06-04-letsencrypt-certific.... If I need a CA, I go for cfssl. Fact, I don’t have ACME via my own CA but it’s not necessary anyway if one is using LE.