 It’s practically impossible to use #https for devices on home networks, such as #iot devices — the #certificate system simply isn’t made for servers behind firewalls. Why? E.g. why can’t I easily get an intermediate (and official) CA cert for my home gateway, which then could issue certs for my devices, maybe in the same breath as assigning local dns names? Is it that simply nobody cares about this use case, and everybody is happy enough with going through vendor clouds? Or why is that? 9 comments
@Edent variety of ways to solve this. Personally, I want to be my own local CA for my own network. So I would get an official domain name, say home.example, get a cert for it (eg letsencrypt) for my gateway device, but that cert would have the flag set that allows it to issue its own certs. I use that to issue CERTs die the devices on my network, all which get a dns name like temperature.home.example. Lots of pieces would have to be made to work, but doable I think.  @J12t This is possible. I have a real domain and I use DNS verification with letsencrypt. I use Cloudflare (I know) and Traefik, my ingress, supports that directly to just make the magic happen. @J12t I do have SSL for a lot of the stuff, but in a kinda cheaty way since I have external resolving DNS which enables generating let’s encrypt certs, and internally I point to the private IP and that enables me to speak https with valid certificates… Yeah not the best solution but works 🤷♂️ @J12t There's a W3C Community Group for this https://www.w3.org/community/httpslocal/ (They haven't come up with a solution yet). @J12t Oh, that's news to me! The W3C have been cracking down on closing inactive community groups recently. The Web of Things Working Group also talk about this issue a lot, so I'll ask if they or the WoT CG might look at this. @J12t If you own a domain it’s pretty simple to get real certs from letsencrypt for non-Internet machines using dns-01 authentication. I use “lego” as a client, but most of the decent acme clients support it. |
Gregory's Server
@J12t That’s a use case that have always bothered me about https in particular and SSL in general.
I wish Let’s Encrypt could provide something here.