4 ms·

Why not just self sign a local cert? Its really easy to do (ask an AI for a relevant example in your language of choice)

rubi1945 2y ago
yes, sure thing it's really easy to do and makes your focus changed on making local https working instead of building your real product https://chatgpt.com/share/9cc6ab14-e777-45a6-92b8-c58bbfb433ab https://chatgpt.com/share/9cc6ab14-e777-45a6-92b8-c58bbfb433...
bavell 2y ago
Yep, this is what I do using mkcert [0] and it works great. One-time setup of 15m to install certs on your dev devices. [0] https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert
- corytheboyd 2y ago
  +1 for mkcert. You can juggle all the openssl dance moves if you want, it’s a decent learning exercise. After you’ve done that once though, and if you only need it for local dev… yeah just use mkcert
johnklos 2y ago
Or why not just use a real cert? Getting a wildcard cert is trivial, as is creating a locally resolving DNS record for your local machine. For tunneling, how is this different / better than ssh -L?
- rubi1945 2y ago
  I don't think real certificate provider could work with .local mDNS address as they need to do some public verification going on the second answer is, ssh -L are just pretty slow on concurrent request, I might think it's just bloat as there is so much thing happen on ssh that not required for tunneling, also it doesn't do vhost natively as on Lokal you can just choose which domain you want to use, and it's just works...
  - johnklos 2y ago
    You can easily have localhost.whateverdomain.whatever for any and all domains and still use virtualhosting. Seems like a solution looking for a problem.
legobeet 2y ago
Here's a batteries-included local-first dev-environment which does that in order to compartmentalize your credentials: https://github.com/legobeat/l7-devenv https://github.com/legobeat/l7-devenv Something like Lokal might till be useful here to facilitate remote collaboration by providing a tunnel (ie I can connect to your local session behind NAT without you opening ports or connect to VPNs etc).
- rubi1945 2y ago
  interesting use case....
modeless 2y ago
I recently found that Tailscale supports procuring real Let's Encrypt certificates for the machines on your private network. So all you have to do on the clients is install Tailscale, which I think is a little easier than trusting self-signed certificates.
- rubi1945 2y ago
  interesting found, while the primary purpose of tailscale are easier P2P connection, I might take a look how this real Let's Encrypt certificate are being used for .local/custom FQDN and implement it on Lokal, appreciate it.
  - modeless 2y ago
    To do it they assign the host a subdomain under .ts.net. But your private host isn't exposed to the public internet, I assume they just have a dummy host there to respond to the ACME challenge from Let's Encrypt. When you have the Tailscale VPN installed, I assume it overrides the DNS for ___.ts.net to point to the private IP of your local host.
  - abctx 2y ago
    https://tailscale.com/blog/tls-certs https://tailscale.com/blog/tls-certs Go implementation at the end of article.
- kxrm 2y ago
  You can also do this yourself with a domain you own and control. I have done it as well when I wanted SSL on my local LAN. My lan is also assigned a real domain so applying a cert is easy to any of my machines.
unshavedyak 2y ago
It's not easy to trust them imo. Browser (rightfully) make it scary sounding, and offhand i don't expect most people know how to install them without the scary warnings (i don't, despite running some locally).
sa46 2y ago
One downside of self-signed certs is that browsers will to upgrade all localhost ports to HTTPS thanks to HSTS. In practical terms, that meant: - we needed to upgrade all dev servers to serve both HTTPS and HTTP. - we downgraded server to server comms to HTTP (something about invalid cert chain) I think the ideal solution is to use “local” domain names but that requires a DNS resolver (via Tailscale or similar).
- jck 2y ago
  I run some software on a raspberry pi at home. This pattern works very well for me: - services exposed via caddy(configured to use my domain on cloudflare for SSL) - my lan dns resolver(adgaurd home) is configured to rewrite these domains to local IP. Specifically, the rewrite rule looks like `homeassistant.mydomain.com -> rpi.lan` - Cloudflare tunnel on the rpi for services I want to access outside. I've it configured to require Google auth via cloudflare zero trust(free) The neat part of this setup is that when I access a service when I'm at home, it works as expected completely locally including https. If I try to access the service through the public internet, it will still work on the exact same domain and also have proper auth through cloudflare. This way I can access anything on the internet from my home server without worrying about security. Cloudflare tunnel also offers some other cool things like ssh on your browser(which again uses the previously mentioned Google auth) if you need it.
- layer8 2y ago
  It only requires an entry in the local hosts file?
  - sa46 2y ago
    I need to map localhost:3000. Ports aren't a part of the hostname, so I can't use /etc/hosts.
    - layer8 2y ago
      In that case a DNS resolver wouldn't help either, unless all your clients perform SRV record lookup.

rubi1945 2y ago

yes, sure thing it's really easy to do and makes your focus changed on making local https working instead of building your real product https://chatgpt.com/share/9cc6ab14-e777-45a6-92b8-c58bbfb433ab https://chatgpt.com/share/9cc6ab14-e777-45a6-92b8-c58bbfb433...

bavell 2y ago

Yep, this is what I do using mkcert [0] and it works great. One-time setup of 15m to install certs on your dev devices. [0] https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert

corytheboyd 2y ago
+1 for mkcert. You can juggle all the openssl dance moves if you want, it’s a decent learning exercise. After you’ve done that once though, and if you only need it for local dev… yeah just use mkcert

johnklos 2y ago

Or why not just use a real cert? Getting a wildcard cert is trivial, as is creating a locally resolving DNS record for your local machine. For tunneling, how is this different / better than ssh -L?

rubi1945 2y ago
I don't think real certificate provider could work with .local mDNS address as they need to do some public verification going on the second answer is, ssh -L are just pretty slow on concurrent request, I might think it's just bloat as there is so much thing happen on ssh that not required for tunneling, also it doesn't do vhost natively as on Lokal you can just choose which domain you want to use, and it's just works...
- johnklos 2y ago
  You can easily have localhost.whateverdomain.whatever for any and all domains and still use virtualhosting. Seems like a solution looking for a problem.

legobeet 2y ago

Here's a batteries-included local-first dev-environment which does that in order to compartmentalize your credentials: https://github.com/legobeat/l7-devenv https://github.com/legobeat/l7-devenv Something like Lokal might till be useful here to facilitate remote collaboration by providing a tunnel (ie I can connect to your local session behind NAT without you opening ports or connect to VPNs etc).

rubi1945 2y ago
interesting use case....

modeless 2y ago

I recently found that Tailscale supports procuring real Let's Encrypt certificates for the machines on your private network. So all you have to do on the clients is install Tailscale, which I think is a little easier than trusting self-signed certificates.

rubi1945 2y ago
interesting found, while the primary purpose of tailscale are easier P2P connection, I might take a look how this real Let's Encrypt certificate are being used for .local/custom FQDN and implement it on Lokal, appreciate it.
- modeless 2y ago
  To do it they assign the host a subdomain under .ts.net. But your private host isn't exposed to the public internet, I assume they just have a dummy host there to respond to the ACME challenge from Let's Encrypt. When you have the Tailscale VPN installed, I assume it overrides the DNS for ___.ts.net to point to the private IP of your local host.
- abctx 2y ago
  https://tailscale.com/blog/tls-certs https://tailscale.com/blog/tls-certs Go implementation at the end of article.
kxrm 2y ago
You can also do this yourself with a domain you own and control. I have done it as well when I wanted SSL on my local LAN. My lan is also assigned a real domain so applying a cert is easy to any of my machines.

unshavedyak 2y ago

It's not easy to trust them imo. Browser (rightfully) make it scary sounding, and offhand i don't expect most people know how to install them without the scary warnings (i don't, despite running some locally).

sa46 2y ago

One downside of self-signed certs is that browsers will to upgrade all localhost ports to HTTPS thanks to HSTS. In practical terms, that meant: - we needed to upgrade all dev servers to serve both HTTPS and HTTP. - we downgraded server to server comms to HTTP (something about invalid cert chain) I think the ideal solution is to use “local” domain names but that requires a DNS resolver (via Tailscale or similar).

jck 2y ago
I run some software on a raspberry pi at home. This pattern works very well for me: - services exposed via caddy(configured to use my domain on cloudflare for SSL) - my lan dns resolver(adgaurd home) is configured to rewrite these domains to local IP. Specifically, the rewrite rule looks like `homeassistant.mydomain.com -> rpi.lan` - Cloudflare tunnel on the rpi for services I want to access outside. I've it configured to require Google auth via cloudflare zero trust(free) The neat part of this setup is that when I access a service when I'm at home, it works as expected completely locally including https. If I try to access the service through the public internet, it will still work on the exact same domain and also have proper auth through cloudflare. This way I can access anything on the internet from my home server without worrying about security. Cloudflare tunnel also offers some other cool things like ssh on your browser(which again uses the previously mentioned Google auth) if you need it.
layer8 2y ago
It only requires an entry in the local hosts file?
- sa46 2y ago
  I need to map localhost:3000. Ports aren't a part of the hostname, so I can't use /etc/hosts.
  - layer8 2y ago
    In that case a DNS resolver wouldn't help either, unless all your clients perform SRV record lookup.