Creating self-signed certificate for localhost and trusting fully

Question

As an accompanyment to a web application we plan to have a node application running as a windows service running on the client computer. This will run a small web server which will listen on port XXXX for information sent from the web application (so the web application will do an Ajax POST to http://localhost:XXXX). The node application has access to do things that a browser based application cannot so it helps us with certain integrations.

The problem is that the web application is running as https and will not allow a POST request to happen to our http service that is running locally.

My questions are:

1. Is it possible to create a self-signed cert for https://localhost so that the user doesn't need to then trust the certificate every time they log on to the computer.

I have tried creating the self-signed cert and adding it to the trusted authority list but I still need to browse to the http://localhost:XXXX in a browser and choose to trust the certificate before I can get the web application to successfully communicate with the node application.

2. Is there any other way around this?

Answer 1

As to the first part of your question. the answer is NO, and all who say it is forget that that also means breaking essential layers of security on the device.

as to the second it is possible but highly dubious to do so. The way to do this is by buying a certificate for a domain (like localapp.example.com) and have its DNS entry point to 127.0.0.1. and than share the key and certificate with the app.

Mind you, this effectively breaks the security layer TLS provides as the key is now on the same machine as the client. and anyone with access to the machine can listen in on that part of the conversation and use your certificate to setup there own service in its place.

I would recommend you get a NEW domain for this purpose and be aware this setup is only so that you can use your webapp in conjunction with your other web services. Which are now vulnerable to more injection attacks due to you having a local web service made part of the full app.