I want to make it easy for users who have private servers to connect to those servers inside their LAN from Android devices.
I want to avoid having these users perform configuration tasks like, trusting self signed certificates, setting up DNS or changing DNS settings in Android (which by default uses Google's
220.127.116.11 DNS server).
I'm considering a way to do this, however it involves delivering a private key for a HTTPS certificate on a domain-name we control, to the user, essentially publishing it.
Assuming the domain name is not used for anything else - is this ever going to be OK from a security perspective (I have noted MITM below)?
The scheme by the way is as follows:
-Obtain a LetsEncrypt wildcard cert. for our domain name
-Setup DNS to point addresses like
-Install the certificate for
*.somedomain.tld on the machine
192.168.1.1 (this requires the private key).
-Now when their Android device tries to load
https://192-168-1-1.somedomain.tld/ it will be pointed to
192.168.1.1 which will serve the page 'securely'.
Potential flaws that I can see:
-Private IPs on public DNS can cause confusion because they will not always point to the same machine or are not always accessible, in my context this isn't an issue.
-Attackers could do a MITM attack between private server and its client.
The context for this is development, and shouldn't be used for production, also I'm tempted to think that to implement a MITM attack on a private network may require the network to be so comprimised already that it would be pointless?