Are the following two ways to obtain server certificates for web servers to host web applications?

Question

https://www.digitalocean.com/community/tutorials/how-to-serve-flask-applications-with-gunicorn-and-nginx-on-ubuntu-18-04#step-6-%E2%80%94-securing-the-application says for running a flask web application with gunicorn and nginx with https:

Certbot provides a variety of ways to obtain SSL certificates through plugins. The Nginx plugin will take care of reconfiguring Nginx and reloading the config whenever necessary. To use this plugin, type the following:

sudo certbot --nginx -d your_domain -d www.your_domain

This runs certbot with the --nginx plugin, using -d to specify the names we’d like the certificate to be valid for.

https://stackoverflow.com/a/59702094/ says that for running an asp.net web application with https:

On Ubuntu the standard mechanism would be:**

• dotnet dev-certs https -v to generate a self-signed cert
• convert the generated cert in ~/.dotnet/corefx/cryptography/x509stores/my from pfx to pem using openssl pkcs12 -in <certname>.pfx -nokeys -out localhost.crt -nodes
• copy localhost.crt to /usr/local/share/ca-certificates
• trust the certificate using sudo update-ca-certificates
• verify if the cert is copied to /etc/ssl/certs/localhost.pem (extension changes)
• verify if it's trusted using openssl verify localhost.crt

I was wondering if the above two ways are to achieve the same goal as obtaining a server certificate for a web server to host a web application?

Specifically, do the single certbot command and the dotnet dev-certs https and openssl commands do the same thing?

Are the two ways working directly on web servers, instead of web applications?

Can the two ways replace each other in their use case scenarios? (suppose dotnet dev-certs https would work on Ubuntu, for simplifying my questions.)

I am new to digital certificate, and have seen the above two approaches for different web application frameworks, and am trying to understand the commonality.

Thanks.

Answer 1

No, they are not the same.

What does certbot do?

certbot is a program by the EFF, which automates the certification process. The command you posted generates a certificate signing request (CSR) for the domains your_domain and www.your_domain. The servers of Let's Encrypt then try to contact your instance of certbot via those domains. If successful, this proves that you indeed own those domains and are thus eligible to generate certificates for it.

It furthermore automatically configures nginx to serve via HTTPS and use these certificates. These certificates will be accepted as legitimate by all modern browsers.

What does dotnet do?

dotnet generates a self-signed certificate. These are useful for development purposes, where you don't expect someone to attempt and spoof your connection. Most likely, you'll connect to localhost anyways.

As a result, while those certificates are indeed real certificates you can use to test your HTTPS configuration, all browsers will warn you that these certificates are not trustworthy. You can either ignore these warnings, with some browsers even allowing options to ignore untrusted certificates on localhost (e.g. Chrome's allow-insecure-localhost flag), or you can manually mark this certificate as verified.

Of course, the purpose of such certificates is debugging and testing. You should never use such certificates in a production environment.

Do these work on web servers or web applications?

The task of a web server is to handle the incoming connections, parse the HTTP request and then pass it on to the web application. The server is therefore the one that handles TLS stuff, such as which TLS version to offer, and which cipher suits to offer.

You could, in theory, let a web application do that, but why would you? The application focuses on what a user does, not on the technical nitty gritty of the connection.

Can the two be swapped?

Yes. certbot and dotnet aren't bound to Ubuntu. You can use each application as you see fit for your use-case, as described above.

Can I have a tl;dr?

Sure. certbot generates a production-ready certificate, but requires an external domain. dotnet generates a self-signed certificate for development. This one is not for production use, but can be generated on your own.

Your web server is what handles all certificate and TLS stuff. Your web application is what handles the logic. It's completely agnostic whether or not it's called via HTTP or HTTPS.

You can use either certbot or dotnet, or even openssl to generate a self-signed certificate. The choice is based on what you need from a certificate.