Welcome to the staging ground for new communities! Each proposal has a description in the "Descriptions" category and a body of questions and answers in "Incubator Q&A". You can ask questions (and get answers, we hope!) right away, and start new proposals.
Proper way to create your own TLS certificates Question
What exactly are the steps to creating your own TLS certificates such that they create minimal error messages for users?
For example, a simple self-signed certificate will trigger a lot of errors in many cases, and every time the certificate is rotated a new exception will need to be created.
A better approach would be to create your own root CA certificate, and use this to sign the certificates you actually use. You would ask users to install the root CA as a one time step, and all browsers and programs should thereafter treat it as a "proper" certificate just like the real ones on the internet, with green checkmark on the lock icon and no nagging about TLS errors. You could also rotate the server cert without having to ask users to reinstall anything.
What exactly are the steps for creating your own TLS certificate for a server (ie. without using any real CA organization), that will result in a smooth user experience?
1 answer
On sandboxes
For sandboxed development and test environments, I have found mkcert to be pretty helpful. It creates a root CA and happily creates certificates for whatever DNS you want.
mkcert warns you not to use it in production. Also, be aware that if you install the root CA to your local computer directly (i.e. not in a carefully partitioned VM or container), someone with access to the private key can mint a certificate for anything and your computer will happily believe it.[1]
Just use Let's Encrypt
The network admin answer is to own a domain name, pick a subdomain (e.g. local.example.com), put your local network on that, and make sure DNS lookups inside the network go to the appropriate place. Then communicate with LetsEncrypt via your DNS for certbot renewals.
One possible downside is that the IP of the computer running the certbot requests will be permanently included in certificate transparency logs. I don't mean to scare anyone, but you should know.
You don't own a domain name
Not a problem. A comment thread below suggests using a public DNS service[2] to be the domain name, and you get to be a subdomain of it. (You can then choose whether your local network's public suffix is one level deeper or the subdomain itself.)
So you really want to be a CA?
The "real" answer ideally involves some kind of HSM to own the key. Then you issue some openssl signing requests. OpenSSL is unfortunately not the most intuitive program to use.
3 comment threads
0 comment threads