Hacker News Reader

Comment by sangeeth96 | Hacker News Reader

It's mentioned in the README:

  - If Caddy has not already generated a local root certificate:
     - Generate a local root certificate to sign TLS certificates
     - Install the local root certificate to the system's trust stores, and the Firefox certificate store if it exists and an be accessed.

So yes. I had written about how I do this directly with Caddy over here: https://automagic.blog/posts/custom-domains-with-https-for-y...

View on HN

But is this an unconstraint root, or does it use name constraints to limit it to localhost domains/IPs? And how does it handle/store the private key associated with that root?

What's your threat model here? The way this works is that on your development machine, localias (through caddy/mkcert) generates a root cert and the per-site certs and installs them to your development machine's trust store. All of the certs live entirely on your device and never leave. You have full control over them and can remove them at any time.

The certs and keys live in the localias application state directory on your machine:

    • tree /Users/pd/Library/Application\ Support/localias/caddy/pki/authorities/local/
    /Users/pd/Library/Application Support/localias/caddy/pki/authorities/local/
    ├── intermediate.crt
    ├── intermediate.key
    ├── root.crt
    └── root.key

The whole nicety of localias is that you can create domain aliases for any domain you can think of, not just ".localhost". For instance, on my machine right now, the aliases are:

    • localias list
    cryptoperps.local -> 3000
    frontend.test -> 3000
    backend.test -> 8080

> Install the local root certificate to the system's trust stores

I really wish there was a safer way to do this, i.e. a way to tag a trusted CA as "valid for localhost use only". The article mentions this in passing

> The sudo version of the above command with the -d flag also works but it adds the certificate to the System keychain for all users. I like to limit privileges wherever possible.

But this is a clear case of https://xkcd.com/1200/.

Maybe this could be done using the name constraint extension marked as critical?

Reply on news.ycombinator.com