What are the risks of deploying a client application with server authentication certificate (private + public key) so that a client application can host a webserver. Which is accessible via HOSTS redirect through the browsers.
What are the risks with the following approach?
- I own the "example.com" domain.
- I get a valid server authentication certificate for "app.example.com", say for e.g. from Comodo.
- I have a web application hosted at "https://www.example.com".
- Users are supposed to do some action which requires me to send some requests to an application running on their system and get a response.
- I do this by installing a client application on user's system.
- This application has the server authentication certificate for "app.example.com" issued above. It can host a locally accessible web server.
- During installation, I add an entry to C:\Windows\System32\drivers\etc\hosts for a redirect from "app.example.com" to "127.0.0.1"
- When user is using the Web application at "https://www.example.com" it also connects to "https://app.example.com" which is actually the client application running on users system.
- Browser can send requests to an application running on their system and get a response.
Things I would like to know: Risks, Fixes, Alternative Approaches etc.
Update: Additional Question: Certificates for localhost, MITM Attack
I preparing a list for why not to do this as asked in the question. As well as for my understanding.
Update: 3 Years down the line Localhost is now recognized as secure context. You no longer require SSL certificate for the same. https://w3c.github.io/webappsec-secure-contexts/#localhost