I have a stupid/crazy idea that I wanted to ask about here. It's probably not going to work, but I'm curious.
Browser security won't allow insecure web sockets (ws://) from secure (https://) pages for various reasons. I'd like to create an app that allows secure web sites to access a lot of different things via WS, and I don't want to have to create SSL certs for everything.
Crazy hack: get a wildcard certificate for a domain (e.g. insecureashell.net) and set up DNS servers to serve IPs encoded in host names under that domain. So for example 188.8.131.52.insecureashell.net would resolve to 184.108.40.206.
Then distribute the private key for this wildcard cert everywhere, allowing all the apps to show up as "secure" from browsers making wss://220.127.116.11.insecureashell.net/ connections.
I'm assuming this violates some kind of cert handling policy in the https CA rules and would get this cert revoked, but I can't find anything to this effect. I also can't think of a reason this is inherently bad, since it would only apply to this specific "phony SSL" domain and nowhere else on the net. CORS headers could be used to allow or deny this, etc.
So why won't this work? :)
Edit: maybe it will. Apparently there are private SSL certs for domains that resolve to 127.0.0.1 on GitHub: https://github.com/Daplie/localhost.daplie.com-certificates