Let's say I am a developer/maintainer of an open-source-webapplication distributed via docker. Any server-admin can install (using docker) and host this webapplication on his server with his own domain.
So the webserver itself is "included" in the docker-image, the user can simply run a container and use the webapplication.
Now I wonder: What is the best-practice regarding tls-integration of such a webapplication?
I think about the following options:
- The webapplication generates a self-signed-certificate or something similar and provide the webservice as HTTPS. Obviously untrusted by every browser, but maybe a little bit better than not using HTTPS.
- The webapplication provide a simple HTTP-server without caring about encryption because it is the server-admin's task to generate and use a certificate for their domain. In this case i would probably force that the server-admin uses something like nginx for example as reverse-proxy which provides a secure connection (using a trusted certificate) for the user.
- (Any completely different approach?)