I have a web application that I ship to users via a setup program. It runs in Windows over IIS Express (ASP.NET) and is available under the localhost domain.

The application currently runs over plain HTTP but I would like to change this, the reason being is that I have some JavaScript in my main web site that communicates with the localhost site. My website runs over https.

Therefore, I was thinking that I could buy a certificate for local.company.com and create a DNS record for local.company.com that points at This means that I would have to ship this certificate with both public and private keys to everyone that downloads my app.

There are practical issues of course such as that the certificate will expire at some point, or that IIS Express will give me a hard time to access it over a domain other than localhost. But before tackling these issues, is this secure? Are there better ways to achieve this?

marked as duplicate by AndrolGenhald, schroeder Dec 10 '18 at 20:15

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Browse other questions tagged or ask your own question.