undefined | Better HN

0 pointstuwtuwtuwtuw2y ago0 comments

What is complicated about local certificate generation?

You can generate one using openssl and then import it to cert store. That's a few minutes of work to create a script and to me seems much less complex than the alternatives of using some third party service. Reminds me of leftpad.

0 comments

4 comments · 1 top-level

8organicbits2y ago· 3 in thread

It depends a lot on what you are doing. The Caddy experience is great as it automates the whole process. But if you run Caddy in a docker container or a VM and connect from the host it's manual again. Maybe you've set up the Firefox trust store, but now Java apps can't connect. Your coworker wants to connect, and now your managing trust stores on other systems.

If you need to write a script, then it's already too complex.

tuwtuwtuwtuwOP2y ago

Of course it will differ depending on scenario. Let's say I only want certs for local debugging and I use Java. I can create a script to generate such a cert and import in 5 minutes. Since it's for local debugging I don't care if cert is leaked so I can store it anywhere.

Which solution is less complex? I followed OPs link to Anchor but was prompted to sign on using anorher third-party service which is already more complex in terms of rolling out in a medium sized team.

reactordev2y ago

“Your coworker wants to connect”

It’s no longer local development now is it? You are crossing into dev deployment land. Unless you are talking about remote pair programming and setting up a reverse proxy at home to allow your coworker to connect or open some port forwards on your router (in which case, the world can connect).

I’m in the camp that can write a 14 line Golang program that can generate a self-signed cert for whatever you want. Anything that needs a root CA is going to need LetsEncrypt or those god awful mafia-esque geotrust/verisign certs.

The certs should be installed on your OS, not your browser. No trust stores to manage. Firefox will use Windows Certificate store, Mac keychain, Linux /etc/ssl/certs.

For client certificates, you can generate a self-signed <dns-name-dejour> so long as your hosts file points the domain to your container IP or localhost.

It’s not that complicated but it’s not trivial if you don’t understand certificates. Having a SaaS service do this for you I think is overkill. certbot could definitely do this. I think web frameworks should do this as part of their new-project process. Considering the world requires https.

8organicbits2y ago

> It’s no longer local development now is it?

I think that's part of the challenge. Your not "doing local development" or "doing dev deployment". Your trying to solve an evolving set of problems. A local CA works for local, but becomes a pain if you ever need something different.

j / k navigate · click thread line to collapse