3 ms·

How do valid certs for localhost work? Does that require installing an unconstraint root certificate to sign the dev certs? Or is there a less risky way (name c

How do valid certs for localhost work? Does that require installing an unconstraint root certificate to sign the dev certs? Or is there a less risky way (name constraints?)

sangeeth96 2y ago
It's mentioned in the README: - If Caddy has not already generated a local root certificate: - Generate a local root certificate to sign TLS certificates - Install the local root certificate to the system's trust stores, and the Firefox certificate store if it exists and an be accessed. So yes. I had written about how I do this directly with Caddy over here: https://automagic.blog/posts/custom-domains-with-https-for-your-localhost-servers-on-macos/ https://automagic.blog/posts/custom-domains-with-https-for-y...
- lxgr 2y ago
  > Install the local root certificate to the system's trust stores I really wish there was a safer way to do this, i.e. a way to tag a trusted CA as "valid for localhost use only". The article mentions this in passing > The sudo version of the above command with the -d flag also works but it adds the certificate to the System keychain for all users. I like to limit privileges wherever possible. But this is a clear case of https://xkcd.com/1200/ https://xkcd.com/1200/. Maybe this could be done using the name constraint extension marked as critical?
- CodesInChaos 2y ago
  But is this an unconstraint root, or does it use name constraints to limit it to localhost domains/IPs? And how does it handle/store the private key associated with that root?
  - peterldowns 2y ago
    What's your threat model here? The way this works is that on your development machine, localias (through caddy/mkcert) generates a root cert and the per-site certs and installs them to your development machine's trust store. All of the certs live entirely on your device and never leave. You have full control over them and can remove them at any time. The certs and keys live in the localias application state directory on your machine: • tree /Users/pd/Library/Application\ Support/localias/caddy/pki/authorities/local/ /Users/pd/Library/Application Support/localias/caddy/pki/authorities/local/ ├── intermediate.crt ├── intermediate.key ├── root.crt └── root.key The whole nicety of localias is that you can create domain aliases for any domain you can think of, not just ".localhost". For instance, on my machine right now, the aliases are: • localias list cryptoperps.local -> 3000 frontend.test -> 3000 backend.test -> 8080
worewood 2y ago
I think an alternative to local root certs would be to use a public cert + dnsmasq on your LAN to resolve the requests to a local address.

How do valid certs for localhost work? Does that require installing an unconstraint root certificate to sign the dev certs? Or is there a less risky way (name constraints?)

sangeeth96 2y ago

It's mentioned in the README: - If Caddy has not already generated a local root certificate: - Generate a local root certificate to sign TLS certificates - Install the local root certificate to the system's trust stores, and the Firefox certificate store if it exists and an be accessed. So yes. I had written about how I do this directly with Caddy over here: https://automagic.blog/posts/custom-domains-with-https-for-your-localhost-servers-on-macos/ https://automagic.blog/posts/custom-domains-with-https-for-y...

lxgr 2y ago
> Install the local root certificate to the system's trust stores I really wish there was a safer way to do this, i.e. a way to tag a trusted CA as "valid for localhost use only". The article mentions this in passing > The sudo version of the above command with the -d flag also works but it adds the certificate to the System keychain for all users. I like to limit privileges wherever possible. But this is a clear case of https://xkcd.com/1200/ https://xkcd.com/1200/. Maybe this could be done using the name constraint extension marked as critical?
CodesInChaos 2y ago
But is this an unconstraint root, or does it use name constraints to limit it to localhost domains/IPs? And how does it handle/store the private key associated with that root?
- peterldowns 2y ago
  What's your threat model here? The way this works is that on your development machine, localias (through caddy/mkcert) generates a root cert and the per-site certs and installs them to your development machine's trust store. All of the certs live entirely on your device and never leave. You have full control over them and can remove them at any time. The certs and keys live in the localias application state directory on your machine: • tree /Users/pd/Library/Application\ Support/localias/caddy/pki/authorities/local/ /Users/pd/Library/Application Support/localias/caddy/pki/authorities/local/ ├── intermediate.crt ├── intermediate.key ├── root.crt └── root.key The whole nicety of localias is that you can create domain aliases for any domain you can think of, not just ".localhost". For instance, on my machine right now, the aliases are: • localias list cryptoperps.local -> 3000 frontend.test -> 3000 backend.test -> 8080

worewood 2y ago

I think an alternative to local root certs would be to use a public cert + dnsmasq on your LAN to resolve the requests to a local address.