3 ms·

This could be an interesting learning opportunity. But for the love of god, I hope nobody copies this parrot-fashion just to get rid of the browser warnings. Th

This could be an interesting learning opportunity. But for the love of god, I hope nobody copies this parrot-fashion just to get rid of the browser warnings. There is no reason to use HTTPS on your LAN. Save yourself the effort and just don't do it.

Arch-TK 3y ago
ZTA is fun to experiment with in your home LAN. And to be fair, most people's networks could benefit from it. That being said, the recommendation in this post is not for proper ZTA.
gregfagan 3y ago
Unless you’re building a web app that requires a secure context. https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts/features_restricted_to_secure_contexts https://developer.mozilla.org/en-US/docs/Web/Security/Secure...
- Already__Taken 3y ago
  yeh secure by default isn't harder than dealing with every edge case and quirk.
- globular-toast 3y ago
  Browsers support *.localhost as a secure context.
jasode 3y ago
>There is no reason to use HTTPS on your LAN. Save yourself the effort and just don't do it. SSL https is definitely a hassle which seems like overkill with private home networks but there can be reasons for it. For example, self-hosted Bitwarden/Vaultwarden password manager doesn't work without https:// https:// SSL. The client UI for managing passwords running in web browsers depend on the Chrome/Firefox cryptography APIs and those don't work for non-encrypted http:// http:// : >Access to the WebCrypto API is restricted to secure origins (which is to say https:// https:// pages). -- from https://www.chromium.org/blink/webcrypto/#:~:text=Access%20to%20the%20WebCrypto%20API%20is%20restricted%20to%20secure%20origins%20(which%20is%20to%20say%20https%3A//%20pages) https://www.chromium.org/blink/webcrypto/#:~:text=Access%20t....
noirscape 3y ago
To be more exact, it's far easier to just shell out the cash for a domain name (or get a free subdomain from somewhere) and then just map the DNS on that domain to your internal infrastructure. That way you can just use letsencrypt certs without any hassle. If you don't want to expose network details, use something like Tailscale to get unique internal IPs and map those. (Don't use Tailscale's own MagicDNS, that one logs individual certificates for machines into CT rather than giving you a wildcard cert for your tailnet).
- globular-toast 3y ago
  Then you'll need a server running locally and the firewall rules to expose that to the internet and either a static IP address or some dynamic DNS client running. No, I think it's far easier to just not do it.
  - guipsp 3y ago
    No, not really. You can obtain the certificate externally and use it internally. The DNS challenge type does not require a web server exposed externally either. Sure, it's far easier not to do it. It's also far easier to have no root password.
  - noirscape 3y ago
    You don't; DNS-01 doesn't require contacting any servers besides the DNS registrar, which is what makes it so nice. In practice, most domain registrars have certbot plugins - you just grab your API key from their customer portal and put it in a file, then run certbot in DNS-01 mode and instruct them to use that. Certbot places a temporary TXT record, which gets verified and the certificate is issued. Then certbot removes the TXT record and that's that. If there's no plugin, you do that by hand, which works but is a bit more involved. You don't need a firewall for that or a DDNS client. Also if you have a weird registrar that only offers you to set NS records, most VPS providers have free DNS services.

Arch-TK 3y ago

ZTA is fun to experiment with in your home LAN. And to be fair, most people's networks could benefit from it. That being said, the recommendation in this post is not for proper ZTA.

gregfagan 3y ago

Unless you’re building a web app that requires a secure context. https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts/features_restricted_to_secure_contexts https://developer.mozilla.org/en-US/docs/Web/Security/Secure...

Already__Taken 3y ago
yeh secure by default isn't harder than dealing with every edge case and quirk.
globular-toast 3y ago
Browsers support *.localhost as a secure context.

jasode 3y ago

>There is no reason to use HTTPS on your LAN. Save yourself the effort and just don't do it. SSL https is definitely a hassle which seems like overkill with private home networks but there can be reasons for it. For example, self-hosted Bitwarden/Vaultwarden password manager doesn't work without https:// https:// SSL. The client UI for managing passwords running in web browsers depend on the Chrome/Firefox cryptography APIs and those don't work for non-encrypted http:// http:// : >Access to the WebCrypto API is restricted to secure origins (which is to say https:// https:// pages). -- from https://www.chromium.org/blink/webcrypto/#:~:text=Access%20to%20the%20WebCrypto%20API%20is%20restricted%20to%20secure%20origins%20(which%20is%20to%20say%20https%3A//%20pages) https://www.chromium.org/blink/webcrypto/#:~:text=Access%20t....

noirscape 3y ago

To be more exact, it's far easier to just shell out the cash for a domain name (or get a free subdomain from somewhere) and then just map the DNS on that domain to your internal infrastructure. That way you can just use letsencrypt certs without any hassle. If you don't want to expose network details, use something like Tailscale to get unique internal IPs and map those. (Don't use Tailscale's own MagicDNS, that one logs individual certificates for machines into CT rather than giving you a wildcard cert for your tailnet).

globular-toast 3y ago
Then you'll need a server running locally and the firewall rules to expose that to the internet and either a static IP address or some dynamic DNS client running. No, I think it's far easier to just not do it.
- guipsp 3y ago
  No, not really. You can obtain the certificate externally and use it internally. The DNS challenge type does not require a web server exposed externally either. Sure, it's far easier not to do it. It's also far easier to have no root password.
- noirscape 3y ago
  You don't; DNS-01 doesn't require contacting any servers besides the DNS registrar, which is what makes it so nice. In practice, most domain registrars have certbot plugins - you just grab your API key from their customer portal and put it in a file, then run certbot in DNS-01 mode and instruct them to use that. Certbot places a temporary TXT record, which gets verified and the certificate is issued. Then certbot removes the TXT record and that's that. If there's no plugin, you do that by hand, which works but is a bit more involved. You don't need a firewall for that or a DDNS client. Also if you have a weird registrar that only offers you to set NS records, most VPS providers have free DNS services.