Chrome’s address bar will use https:// by default

Re:Chrome’s address bar will use https:// by default by heinrichhartman on Tuesday March 23, 2021 @05:01PM (#26560349)

I have tried to do just that but ran into all kinds of difficulties:

1. Overhead: I have 5 devices that I own 3 of my wife and a smart TV. Setting all this us takes a lot of time, even if it worked fine.

2. What about visitors to my home, that I want to give access? They need the cert as well together with lengthy instructions on how to install it.

3. How do I even install certs on an iPhone?

4. Firefox uses it's own Certificate Database -- for each profile. So I'll have to install certs on the system AND on the host (for e.g. Chrome to find it).

5. All these steps need to be repeated every year (90 days?!) depending on the cert expiration period.

Eventually I just gave up on this. It's not practical. There needs to be a better solution.

[ Parent | on HN ]

Re:Chrome’s address bar will use https:// by default by rblatz on Tuesday March 23, 2021 @10:47PM (#26563001)

I bought a domain For use on my local network. I use letsencrypt for free certs, and I have multiple sub domains hosted under it. It works very well and wasn’t that hard to setup. It’s actually better organized and easier to use than my old system since I had to take the extra step up front to organize it under a domain.

[ Parent | on HN ]

Re:Chrome’s address bar will use https:// by default by greggman3 on Tuesday March 23, 2021 @09:50PM (#26562630)

I am as upset as you about this and cancelled IoT related projects because of it

But, #3 How do I even install certs on an iPhone

AFAIK (though I've never done it) you use a configuration profile

https://developer.apple.com/documentation/devicemanagement/c...

https://support.apple.com/guide/deployment-reference-ios/cer...

[ Parent | on HN ]

Re:Chrome’s address bar will use https:// by default by isignal on Tuesday March 23, 2021 @07:31PM (#26561708)

https://news.ycombinator.com/item?id=17748208

I found the steps described in https://github.com/FiloSottile/mkcert reasonable to follow. It describes an iOS workflow too.

[ Parent | on HN ]

Re:Chrome’s address bar will use https:// by default by katbyte on Tuesday March 23, 2021 @10:36PM (#26562917)

15$ a year for a domain, throw traffic through local [split?] dns and traefik with the lets encrypt dns challenge and call it a day? i have over 25 internal domains & services with 25 certs auto renewing and no one can tell - it just works and is easier the self signing certs and loading them into whatever rando service or device your trying to secure

[ Parent | on HN ]

Re:Chrome’s address bar will use https:// by default by midasuni on Wednesday March 24, 2021 @02:14AM (#26564109)

Split dns is dying - doh is sorting that. Sure canary domains exist, but they won’t forever

[ Parent | on HN ]

Re:Chrome’s address bar will use https:// by default by katbyte on Wednesday March 24, 2021 @02:53AM (#26564263)

i'm not sure i follow, what does split DNS have to do with DoH? i don't want my internal DNS addresses public, there is no need + security and for some addresses i have different IPs internal vs external.

[ Parent | on HN ]

Re:Chrome’s address bar will use https:// by default by midasuni on Wednesday March 24, 2021 @04:51AM (#26564900)

Browsers send to external provider like google, rather than the network provided server which has the internal addresses (and which may override external addresses for various reasons)

[ Parent | on HN ]

Re:Chrome’s address bar will use https:// by default by katbyte on Saturday March 27, 2021 @06:22PM (#26606148)

split-dns will never die, it would kill far to many internal corp environments where there is no public DNS entries.

[ Parent | on HN ]

Re:Chrome’s address bar will use https:// by default by spockz on Tuesday March 23, 2021 @05:25PM (#26560593)

I have been looking at using MDM for my iPhone so I can install trusted root certs and require it to be on vpn when not using a specific list of WiFi networks.

It is a hassle and as far as I could see it requires resetting the device and I’m not sure I can restore my backup over it and retain both.

[ Parent | on HN ]

Re:Chrome’s address bar will use https:// by default by zaarn on Tuesday March 23, 2021 @06:35PM (#26561210)

If you keep your CA secure, no reason that you can't set the expiration of the root cert to something like 10 years.

[ Parent | on HN ]

Re:Chrome’s address bar will use https:// by default by tsimionescu on Wednesday March 24, 2021 @12:45AM (#26563675)

Will browsers accept that?

[ Parent | on HN ]

Re:Chrome’s address bar will use https:// by default by zaarn on Wednesday March 24, 2021 @10:25AM (#26567618)

Browsers accept a root CA with long lifetime. Certs signed by CAs installed by the user or admin also allow long lifetimes (probably will still for a while).

[ Parent | on HN ]