Hacker News Reader

Comment by brrrrrm | Hacker News Reader

Why not just self sign a local cert? Its really easy to do (ask an AI for a relevant example in your language of choice)

View on HN

Yep, this is what I do using mkcert [0] and it works great. One-time setup of 15m to install certs on your dev devices.

[0] https://github.com/FiloSottile/mkcert

+1 for mkcert. You can juggle all the openssl dance moves if you want, it’s a decent learning exercise. After you’ve done that once though, and if you only need it for local dev… yeah just use mkcert

I recently found that Tailscale supports procuring real Let's Encrypt certificates for the machines on your private network. So all you have to do on the clients is install Tailscale, which I think is a little easier than trusting self-signed certificates.

interesting found, while the primary purpose of tailscale are easier P2P connection, I might take a look how this real Let's Encrypt certificate are being used for .local/custom FQDN and implement it on Lokal, appreciate it.

To do it they assign the host a subdomain under .ts.net. But your private host isn't exposed to the public internet, I assume they just have a dummy host there to respond to the ACME challenge from Let's Encrypt. When you have the Tailscale VPN installed, I assume it overrides the DNS for ___.ts.net to point to the private IP of your local host.

https://tailscale.com/blog/tls-certs

Go implementation at the end of article.

You can also do this yourself with a domain you own and control. I have done it as well when I wanted SSL on my local LAN. My lan is also assigned a real domain so applying a cert is easy to any of my machines.

One downside of self-signed certs is that browsers will to upgrade all localhost ports to HTTPS thanks to HSTS. In practical terms, that meant:

- we needed to upgrade all dev servers to serve both HTTPS and HTTP. - we downgraded server to server comms to HTTP (something about invalid cert chain)

I think the ideal solution is to use “local” domain names but that requires a DNS resolver (via Tailscale or similar).

I run some software on a raspberry pi at home. This pattern works very well for me:

- services exposed via caddy(configured to use my domain on cloudflare for SSL)

- my lan dns resolver(adgaurd home) is configured to rewrite these domains to local IP. Specifically, the rewrite rule looks like `homeassistant.mydomain.com -> rpi.lan`

- Cloudflare tunnel on the rpi for services I want to access outside. I've it configured to require Google auth via cloudflare zero trust(free)

The neat part of this setup is that when I access a service when I'm at home, it works as expected completely locally including https.

If I try to access the service through the public internet, it will still work on the exact same domain and also have proper auth through cloudflare. This way I can access anything on the internet from my home server without worrying about security.

Cloudflare tunnel also offers some other cool things like ssh on your browser(which again uses the previously mentioned Google auth) if you need it.

It only requires an entry in the local hosts file?

I need to map localhost:3000. Ports aren't a part of the hostname, so I can't use /etc/hosts.

In that case a DNS resolver wouldn't help either, unless all your clients perform SRV record lookup.

Here's a batteries-included local-first dev-environment which does that in order to compartmentalize your credentials:

https://github.com/legobeat/l7-devenv

Something like Lokal might till be useful here to facilitate remote collaboration by providing a tunnel (ie I can connect to your local session behind NAT without you opening ports or connect to VPNs etc).

interesting use case....

It's not easy to trust them imo. Browser (rightfully) make it scary sounding, and offhand i don't expect most people know how to install them without the scary warnings (i don't, despite running some locally).

Or why not just use a real cert? Getting a wildcard cert is trivial, as is creating a locally resolving DNS record for your local machine.

For tunneling, how is this different / better than ssh -L?

I don't think real certificate provider could work with .local mDNS address as they need to do some public verification going on

the second answer is, ssh -L are just pretty slow on concurrent request, I might think it's just bloat as there is so much thing happen on ssh that not required for tunneling, also it doesn't do vhost natively as on Lokal you can just choose which domain you want to use, and it's just works...

You can easily have localhost.whateverdomain.whatever for any and all domains and still use virtualhosting. Seems like a solution looking for a problem.

yes, sure thing it's really easy to do and makes your focus changed on making local https working instead of building your real product

https://chatgpt.com/share/9cc6ab14-e777-45a6-92b8-c58bbfb433...

Reply on news.ycombinator.com