2

Excerpt from https://letsencrypt.org/docs/certificates-for-localhost/

You might be tempted to work around these limitations by setting up a domain name in the global DNS that happens to resolve to 127.0.0.1 (for instance, localhost.example.com), getting a certificate for that domain name, shipping that certificate and corresponding private key with your native app, and telling your web app to communicate with https://localhost.example.com:8000/ instead of http://127.0.0.1:8000/. Don’t do this. It will put your users at risk, and your certificate may get revoked.

By introducing a domain name instead of an IP address, you make it possible for an attacker to Man in the Middle (MitM) the DNS lookup and inject a response that points to a different IP address. The attacker can then pretend to be the local app and send fake responses back to the web app, which may compromise your account on the web app side, depending on how it is designed.

Can some one explain how this MITM attack will be carried out? Assuming I own the TLD example.com. I also add an HOSTS redirect for localhost.example.com to 127.0.0.1 when the native app is installed.

Improve this question

1 Answer 1

Reset to default
2

If you add a HOSTS entry for localhost.example.com and the certificate covers only localhost.example.com then no MITM attack within the network against your system is possible since your system will use the entry from HOSTS and not use DNS to lookup the domain.

But, if the application which includes this certificate is not only used by you but by others then everybody must also add such HOSTS entry in order to be safe. You probably cannot expect this.

Additionally an attacker can extract certificate and private key from the application and in some cases use it against users which don't even run the application. For example if login.example.com sets a session cookie with scope of domain *.example.com then this session cookie can also be read when accessing localhost.example.com - and a successful MITM of this domain is possible using the extracted certificate and private key.

Improve this answer
3
  • What if the local app installer adds the HOSTS redirect? Also will it be possible for an attacker to impersonate localhost.example.com if I own example.com?
    – AEonAX
    Commented Dec 7, 2018 at 9:20
  • 1
    @AEonAX: "What if the local app installer adds the HOSTS redirect?" - As I said, there is no problem for systems where the HOSTS file is modified to resolve the name but for other systems. And, can you really guarantee that the HOSTS file stays this way and is not replaced or reset? -- "... impersonate localhost.example.com if I own example.com..." - It does not matter which domain you own - all it matters for which domains the attacker can get a valid certificate. If your certificate is only for localhost.example.com then example.com can not be impersonated with this certificate.
    – Steffen Ullrich
    Commented Dec 7, 2018 at 9:26
  • all it matters for which domains the attacker can get a valid certificate - I got it now
    – AEonAX
    Commented Dec 7, 2018 at 9:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .