I always find it a pain to create a new key for development and I was thinking of doing something like this both for myself and to help other developers out:
- Register a domain like
- Get a wildcard ssl certificate
- Make both the certificate and private key files available to the public
- Test my sites locally by adding entries to my host files for whatever I want to test (i.e. api.fakesite.com, www.fakesite.com, etc.) either pointing to 127.0.0.1 or to my ip on my local network and using the publicly available certificate and private key.
fakesite.com would send all subdomains to one page on the main website which would explain what it was for. The actual certificate and private key would be made available elsewhere such as in a github repository.
The only problems I could think of would be
1) Attacker can perform a MITM attack rerouting your DNS to their website, which they can make look secure by using the publicly available 'private key', and trick you into browsing to a web page like 'citibank.fakesite.com' and entering your information.
2) As a developer I mistype a url and sent traffic to apu.fakesite.com, which is being used like above so they can capture the traffic I was meaning to send to my local computer
It actually seems more secure for me as a developer than creating a self-signed certificate using publicly available tools and having the key sitting around on my hard drive for my tools to use. If anyone got that, they could spoof any website for me because I have to trust it, right?
By using someplace like letsencrypt for the authority, they can say my certificate/key is only valid for that one domain, which should only be used for local testing and development.
Are there issues I'm not thinking about, or is #1 likely enough that this would be a bad idea?