4 ms·

Avoid using `.local`. In my experience Chrome does not like it with HTTPS. It takes much much longer to resolve. I found a Chrome bug relating to this but do no

Avoid using `.local`. In my experience Chrome does not like it with HTTPS. It takes much much longer to resolve. I found a Chrome bug relating to this but do not have it handy to share. `.localhost` makes more sense for local development anyways.

EGreg 2y ago
Actually, MacOS gives your computer a .local domain on DHCP and Bonjour usually
defraudbah 2y ago
if you add your CA to the list of trusted certificate, everything will be fine. I do not recommend using custom certificates and would stick to http, unless you really know what you are doing
jeroenhd 2y ago
I use .local all the time and it works just fine. For TLS I use my existing personal CA, but HTTP links don't cause issues for me. That said, I do use mDNS/Bonjour to resolve .local addresses (which is probably what breaks .local if you're using it as a placeholder for a real domain). Using .local as a imaginary LAN domain is a terrible idea. These days, .internal is reserved for that.
rcarmo 2y ago
.local is mDNS/Rendezvous/Bonjour territory. In some cases it takes longer to resolve because your machine will multicast a query for the owner of the name. I use it extensively on my LAN with great success, but I have Macs and Linux machines with Avahi. People who don't shouldn't mess with it...
zamadatix 2y ago
The reason is .local is a special case TLD for link-local networking with name resolution through things like mdns, by trying to hijack it for other use things might not go as you intend. Alternatively, .localhost is just a reserved TLD so it has no other usage to check. https://en.wikipedia.org/wiki/.local https://en.wikipedia.org/wiki/.local https://en.wikipedia.org/wiki/.localhost https://en.wikipedia.org/wiki/.localhost
deleted 2y ago
[deleted]
Pxtl 2y ago
Honestly, if I had my druthers there would be a standardized exception for .local domains that self-signed HTTPS certs would be accepted without known roots. It's insane how there's no good workflow for HTTPS on LAN-only services.
- Spooky23 2y ago
  It’s actually gotten worse, you need to run a CA or use a public domain where it’s easy to get your internal naming schemes in a transparency log.
  - jeroenhd 2y ago
    The easy workaround I've seen companies use for that is by using a basic wildcard certificate (*.local.mydomain.biz).
- jeroenhd 2y ago
  Technically speaking you could use DANE with mDNS. Nobody does it, browser don't implemented it, but you can follow the spec if you'd like. Practically speaking, HTTPS on LAN is essentially useless, so I don't see the benefits. If anything, the current situation allows the user to apply TOFU to local devices by adding their unsigned certs to the trust store.
  - mohsen1 2y ago
    Some more modern browser APIs only work in HTTPS. That's why I had to do it.
    - jeroenhd 2y ago
      Modern browsers only enable those APIs because of security concerns, and those security concerns aren't lifted just because you're connected locally. The existing exception mechanisms already work for this, all you need to do is click the "continue anyway" button.
  - 1wheel 2y ago
justin_oaks 2y ago
I recommend using the .test TLD. * It's reserved so it's not going to be used on the public internet. * It is shorter than .local or .localhost. * On QWERTY keyboards "test" is easy to type with one hand.

EGreg 2y ago

Actually, MacOS gives your computer a .local domain on DHCP and Bonjour usually

defraudbah 2y ago

if you add your CA to the list of trusted certificate, everything will be fine. I do not recommend using custom certificates and would stick to http, unless you really know what you are doing

jeroenhd 2y ago

I use .local all the time and it works just fine. For TLS I use my existing personal CA, but HTTP links don't cause issues for me. That said, I do use mDNS/Bonjour to resolve .local addresses (which is probably what breaks .local if you're using it as a placeholder for a real domain). Using .local as a imaginary LAN domain is a terrible idea. These days, .internal is reserved for that.

rcarmo 2y ago

.local is mDNS/Rendezvous/Bonjour territory. In some cases it takes longer to resolve because your machine will multicast a query for the owner of the name. I use it extensively on my LAN with great success, but I have Macs and Linux machines with Avahi. People who don't shouldn't mess with it...

zamadatix 2y ago

The reason is .local is a special case TLD for link-local networking with name resolution through things like mdns, by trying to hijack it for other use things might not go as you intend. Alternatively, .localhost is just a reserved TLD so it has no other usage to check. https://en.wikipedia.org/wiki/.local https://en.wikipedia.org/wiki/.local https://en.wikipedia.org/wiki/.localhost https://en.wikipedia.org/wiki/.localhost

deleted 2y ago

[deleted]

Pxtl 2y ago

Honestly, if I had my druthers there would be a standardized exception for .local domains that self-signed HTTPS certs would be accepted without known roots. It's insane how there's no good workflow for HTTPS on LAN-only services.

Spooky23 2y ago
It’s actually gotten worse, you need to run a CA or use a public domain where it’s easy to get your internal naming schemes in a transparency log.
- jeroenhd 2y ago
  The easy workaround I've seen companies use for that is by using a basic wildcard certificate (*.local.mydomain.biz).
jeroenhd 2y ago
Technically speaking you could use DANE with mDNS. Nobody does it, browser don't implemented it, but you can follow the spec if you'd like. Practically speaking, HTTPS on LAN is essentially useless, so I don't see the benefits. If anything, the current situation allows the user to apply TOFU to local devices by adding their unsigned certs to the trust store.
- mohsen1 2y ago
  Some more modern browser APIs only work in HTTPS. That's why I had to do it.
  - jeroenhd 2y ago
    Modern browsers only enable those APIs because of security concerns, and those security concerns aren't lifted just because you're connected locally. The existing exception mechanisms already work for this, all you need to do is click the "continue anyway" button.
- 1wheel 2y ago

justin_oaks 2y ago

I recommend using the .test TLD. * It's reserved so it's not going to be used on the public internet. * It is shorter than .local or .localhost. * On QWERTY keyboards "test" is easy to type with one hand.