Hacker News Reader

Comment by FiloSottile | Hacker News Reader

Good ideas are rarely unique, as they usually solve a common problem. I recently built something similar:

It's in pure Go instead of using OpenSSL, and it works with Windows, macOS and Firefox, too.

Yours is a much more robust solution that I wish I had found before writing my own. But at least I got a better understanding with how all of this stuff works.

I've added a link to your project in my README.md file.

Personally, I tend to use the easy-rsa set of scripts https://github.com/OpenVPN/easy-rsa.

Initially they used to come as a goodies with OpenVPN, but they are now provided as a standalone project.

There are already packaged and available in most distributions (easy-rsa package under Debian for example).

There are probably a little bit more complex to use, but it's far from horrible, and it's quite battle tested.

Thanks for creating such a easy to use tool for solving an annoying "problem" with local certs. I never really tried to solve this myself so I just "put up" with the browser warning. I managed to add a key following the README on your repo with no problems what so ever on MacOSX. :)

Fascinating that Golang reimplemented all the crypto/ssl/tls in Golang itself rather than linking to a C library. I'd probably trust the Go code (a safer language) over OpenSSL so that's a pretty interesting use case.

Why? Surely OpenSSL has a bigger team auditing the codebase, especially recently since they've gotten so much attention for previous security failures.

Also, Go's TLS library is missing some important features, like decrypting most varieties of private keys.

I use Go's TLS library, but I don't think it's necessary "better" than openssl, though it's certainly more convenient.

I'm making no definitive statements just more interested that they did it. I would personally trust a new Go codebase over an old C codebase but I could definitely be wrong in this case.

Reply on news.ycombinator.com