Hacker News Reader

Comment by zokier | Hacker News Reader

I don't know why there is still no standardization for advertising/providing CA services for local networks. How difficult would it be to just put local ACME endpoint to DHCP options?

View on HN

This sounds great acually. Browsers should only trust them when connecting to local IPs (based on subnet or something), is displayed as a gray padlock that says "Local", the ACME endpoint should be restricted to only giving out certs on specific domains (.local or something), and to reissue any cert with the same name as a previous cert the device has to prove that it's the same (unique embedded public key or something). Maybe an exception that devices can always get a local cert for its IP, and the owner of the ACME device can assign "pretty" names to "unique" names on a case-by-case basis.

The thing issuing DHCP leases has full control over your ability to connect to the internet anyways, so around here seems like the right place to put it.

My only qualm is that I trust router manufacturers to implement this correctly about as far as I can throw a sheet of paper.

But then what’s the point? How is it more secure to have anyone get a server cert automatically without credentialing. Not to mention training users to trust all the BS local CAs popping up now that can then MITM traffic.

As a user, I don’t want local networks setting me up to make me recognize their CA services.

At first I liked SSL everywhere, but now I’m seeing a lot of hacks that are going to make SSL less useful.

Not to mention training users to trust all the BS local CAs popping up now that can then MITM traffic.

You say that as if users don't already mindlessly dismiss most warnings already. I'm not convinced this would be that big of a difference from the current system.

adding a local CA means you can middleman anything you want to, seems like something that should be difficult to do, to me.

Name constraints are a thing. Local CA should be constrained to signing only local names (roughly matching dhcp domain-name/domain-search options).

Name constraints are not universally supported in browsers sadly.

And this should be fixed. Name constraints would be incredibly useful for a number of things, if only they were supported.

I believe Apple is the holdout in this case, meaning Safari and Chrome on MacOS don't support it.

ACME has nothing to do with provisioning root certificate trust stores and I hope DHCP never will either. If you need additional local root CAs then deploy them via enterprise workstation management solutions.

Reply on news.ycombinator.com