0

https://www.digitalocean.com/community/tutorials/how-to-serve-flask-applications-with-gunicorn-and-nginx-on-ubuntu-18-04#step-6-%E2%80%94-securing-the-application says for running a flask web application with gunicorn and nginx with https:

Certbot provides a variety of ways to obtain SSL certificates through plugins. The Nginx plugin will take care of reconfiguring Nginx and reloading the config whenever necessary. To use this plugin, type the following:

sudo certbot --nginx -d your_domain -d www.your_domain

This runs certbot with the --nginx plugin, using -d to specify the names we’d like the certificate to be valid for.

https://stackoverflow.com/a/59702094/ says that for running an asp.net web application with https:

On Ubuntu the standard mechanism would be:**

  • dotnet dev-certs https -v to generate a self-signed cert
  • convert the generated cert in ~/.dotnet/corefx/cryptography/x509stores/my from pfx to pem using openssl pkcs12 -in <certname>.pfx -nokeys -out localhost.crt -nodes
  • copy localhost.crt to /usr/local/share/ca-certificates
  • trust the certificate using sudo update-ca-certificates
  • verify if the cert is copied to /etc/ssl/certs/localhost.pem (extension changes)
  • verify if it's trusted using openssl verify localhost.crt

I was wondering if the above two ways are to achieve the same goal as obtaining a server certificate for a web server to host a web application?

Specifically, do the single certbot command and the dotnet dev-certs https and openssl commands do the same thing?

Are the two ways working directly on web servers, instead of web applications?

Can the two ways replace each other in their use case scenarios? (suppose dotnet dev-certs https would work on Ubuntu, for simplifying my questions.)

I am new to digital certificate, and have seen the above two approaches for different web application frameworks, and am trying to understand the commonality.

Thanks.

3

No, they are not the same.

What does certbot do?

certbot is a program by the EFF, which automates the certification process. The command you posted generates a certificate signing request (CSR) for the domains your_domain and www.your_domain. The servers of Let's Encrypt then try to contact your instance of certbot via those domains. If successful, this proves that you indeed own those domains and are thus eligible to generate certificates for it.

It furthermore automatically configures nginx to serve via HTTPS and use these certificates. These certificates will be accepted as legitimate by all modern browsers.

What does dotnet do?

dotnet generates a self-signed certificate. These are useful for development purposes, where you don't expect someone to attempt and spoof your connection. Most likely, you'll connect to localhost anyways.

As a result, while those certificates are indeed real certificates you can use to test your HTTPS configuration, all browsers will warn you that these certificates are not trustworthy. You can either ignore these warnings, with some browsers even allowing options to ignore untrusted certificates on localhost (e.g. Chrome's allow-insecure-localhost flag), or you can manually mark this certificate as verified.

Of course, the purpose of such certificates is debugging and testing. You should never use such certificates in a production environment.

Do these work on web servers or web applications?

The task of a web server is to handle the incoming connections, parse the HTTP request and then pass it on to the web application. The server is therefore the one that handles TLS stuff, such as which TLS version to offer, and which cipher suits to offer.

You could, in theory, let a web application do that, but why would you? The application focuses on what a user does, not on the technical nitty gritty of the connection.

Can the two be swapped?

Yes. certbot and dotnet aren't bound to Ubuntu. You can use each application as you see fit for your use-case, as described above.

Can I have a tl;dr?

Sure. certbot generates a production-ready certificate, but requires an external domain. dotnet generates a self-signed certificate for development. This one is not for production use, but can be generated on your own.

Your web server is what handles all certificate and TLS stuff. Your web application is what handles the logic. It's completely agnostic whether or not it's called via HTTP or HTTPS.

You can use either certbot or dotnet, or even openssl to generate a self-signed certificate. The choice is based on what you need from a certificate.

| improve this answer | |
  • Thanks. (1) What is dotenv? (2) Is there a more platform agnostic way than dotnet dev-certs https -v? How do people in Linux do self signing server certificates? (3) Is certbot the tool most often tool for externally signing server certificates? – Tim Feb 27 at 10:49
  • @Tim A quick google search would have answered what dotenv is. And no, you have to check with your platform what the best way to generate a self-signed certificate is. Then again, most platforms already come with a simple way to generate a self-signed certificate for localhost for precisely this reason. – MechMK1 Feb 27 at 10:51
  • Thanks. (1) Do you mean choice of tool for self signing server certificate highly depends on the web application framework and OS? Can self signed certificate created by dotnet dev-certs https -v be used for web applications not created by ASP.NET core? Isn't it that server certificate is handled by web server not web applications? (2) Do you mean choice of tool for externally signing server certificate highly depends on the web application framework and OS? – Tim Feb 27 at 10:56
  • @Tim No, a certificate is a certificate. You can generate one for one server and use it on another. But for example, if you use Visual Studio on Windows, you'd use other tools than on Linux. And no, the choice of tools depends on whether you want to set up a dev environment or a production-ready server. – MechMK1 Feb 27 at 11:11
  • Thanks. How "The servers of Let's Encrypt then try to contact your instance of certbot via those domains"? The domains are for running websites, the instance of cerbot is running on a computer. – Tim Feb 27 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.