3 ms·
Some things I learned about trusted localhost HTTPS: * Windows is the easiest... by far. There is only one trust store and its extremely easy to access at dif
by austin-cheney 3y ago
Some things I learned about trusted localhost HTTPS:
* Windows is the easiest... by far. There is only one trust store and its extremely easy to access at different levels of trust. Firefox has its own trust store so you can either add your certs to both the Windows store AND the Firefox trust store or flip a config in Firefox to tell it to use the Windows trust store like everyone else.
* Linux is a challenge because you have to add your certificates to the OS trust store and then each browser has their own trust stores.
* MacOS is pretty close to impossible, at least fully automated. If the cert is not registered with a third party of the OS's choosing the cert will not be trusted in the browser. The way around this is to manually add your localhost cert chain to the MacOS keychain.
If anybody wants an example here is something I wrote a ways back in JS (but please be warned its specific to my application:
* Build the certificate chain - https://github.com/prettydiff/share-file-systems/blob/master/lib/terminal/commands/library/build.ts#L403-L511 https://github.com/prettydiff/share-file-systems/blob/master...
* Install the cert by OS type - https://github.com/prettydiff/share-file-systems/blob/master/lib/terminal/commands/library/build.ts#L403-L511 https://github.com/prettydiff/share-file-systems/blob/master...
That second sample also installs pcap so that I can serve on localhost over ports 80/443.
- everforward 3y ago> * Linux is a challenge because you have to add your certificates to the OS trust store and then each browser has their own trust stores. I could be wrong, but I could have sworn Firefox trusts the OS' certificate store. Maybe it's just been too long since I've done it.
- austin-cheney 3y agoFirefox has its own cert store, even on Windows. You can make it defer to the OS trust store with an option in the about:config.
- everforward 3y agoYeah, I know about that part, but I could have sworn that Firefox on Ubuntu trusts the intersection of it's trust store and the OS trust store (with Firefoxs store having priority). Were you using the package manager packages? I'm a little surprised if the distro packages don't configure Firefox to use the OS trust store. I would not be surprised if the binaries Firefox provides directly don't trust the OS package store. They probably shouldn't, given that the path to the OS trust store is configurable. I think Ubuntu and Fedora use slightly different paths. Seems like a security nightmare to try guessing at what directory has the OS trust store. Better to leave it to the package maintainers to specifically customize it for their distro's patterns.