I develop applications on my local computer that I later deploy to a TLS production server. Should I develop with TLS on or off?

  • 1
    Security is not a product but a process. It is better to start by taking into account security measures right at the beginning instead of trying to bolt them on afterwards. Some interesting reading about TLS in applications outside of the web realm and some frequent errors: cs.utexas.edu/~shmat/shmat_ccs12.pdf – Patrick Mevzek May 30 '18 at 23:14

The answer is simple - yeah, dev using TLS. Here's why:

  1. You need to set the secure flag on cookies
  2. You want to make sure all resources accessed are https
  3. You might forget to turn on TLS dependencies when you deploy your code to production
  4. It's easy to do this. Go use acme.sh to register a let's encrypt cert using DNS for domain verification. Create a DNS A record that points to Done.
  5. Don't use self signed certs because I don't want you forming a habit of clicking past TLS warnings

If you really really don't want to....

Then you need a post deploy compensating control. That means scan your website looking for TLS dependancies like the cookie secure flag. Use qualys free scanner to probe your site for issues like this.

  • I sort of agree that it's a good "best practice" for most people Regarding "let's encrypt" however, very few developers either have their development environments directly accessible on the internet, or have direct control over the DNS records. The point being, creating a Lets Encrypt Cert isn't really something many/most developers can possibly even do. – Steve Sether May 30 '18 at 21:15
  • I myself could likely do this, though I work in an extremely free environment. When I worked for a Fortune 100 company however, there's no way I could have done this. – Steve Sether May 30 '18 at 21:19
  • You could install your self signed cert in your browser to avoid the clickthrough issue. That implies you have root or admin permissions, which many developers don't. – Steve Sether May 30 '18 at 21:21
  • Hmm. These are good points. In the past, I've created a dns name like localhost.company.com pointed to and bought a 1 or 2 year long cert, and distributed that. – Jonathan May 30 '18 at 22:03
  • "Create a DNS A record that points to Done." this is exactly NOT recommended by Let's Encrypt, see: letsencrypt.org/docs/certificates-for-localhost. Self-signed certificates are completely fine for local development. They are not a bad habit per se. The bad habit is not checking the issuer of a certificate and not acting correctly upon it. – Patrick Mevzek May 30 '18 at 23:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.