1

Let's say I am a developer/maintainer of an open-source-webapplication distributed via docker. Any server-admin can install (using docker) and host this webapplication on his server with his own domain.

So the webserver itself is "included" in the docker-image, the user can simply run a container and use the webapplication.

Now I wonder: What is the best-practice regarding tls-integration of such a webapplication?

I think about the following options:

  • The webapplication generates a self-signed-certificate or something similar and provide the webservice as HTTPS. Obviously untrusted by every browser, but maybe a little bit better than not using HTTPS.
  • The webapplication provide a simple HTTP-server without caring about encryption because it is the server-admin's task to generate and use a certificate for their domain. In this case i would probably force that the server-admin uses something like nginx for example as reverse-proxy which provides a secure connection (using a trusted certificate) for the user.
  • (Any completely different approach?)
Improve this question

1 Answer 1

Reset to default
1

Disclaimer: The scenario described is quite generic in terms of licensing of the said software, therefore I will consider it as open-source, where the provider is not legally bound to how the software is used, nor the consequences of misconfigurations.

A valid approach would be to deliver the application only with HTTP enabled, and also provide the necessary documentation on how to configure HTTPS, leaving the choice and responsibility in the hands of the system administrator.

The company I work for operates in this exact scheme, and it enables the customers to easily run and test the application since HTTPS is not required, whilst properly guiding customers/system administrators on how to configure HTTPS, that is always a requirement for production environments.

Improve this answer
5
  • -1: "Insecure by default" as recommendation for a modern application is very bad advice.
    – user163495
    Feb 11, 2021 at 1:59
  • 1
    @MechMK1 How would a software vendor deliver on-premise software with HTTPS configured if the user/customer is the only one able to request a CA-signed certificate for it's domain? This is not advice is simply a matter of responsibility. httpd is delivered without HTTPS enabled for a logical reason...
    – Filipe dos Santos
    Feb 12, 2021 at 16:04
  • By requesting the user to upload certificate and private key upon installation. I know that delegating the responsibility of security to the user is the "easy way out", but it will end up with 80% of these installations being HTTP only because nobody bothered reading the docs and "hey, it works"
    – user163495
    Feb 12, 2021 at 16:39
  • 1
    And still I wonder why all major open-source application servers don't enforce this... Real world scenarios cannot be bound to absurd show stopper configuration requirements. A software provider can only do so much, the user has it's responsibilities in this scenario, and a well written thorough documentation is the industry best-practice.
    – Filipe dos Santos
    Feb 19, 2021 at 17:37
  • 1
    Made up anecdotal percentages ("80% of these installations") are also unhelpful, since real world scenario have strict compliance regulations to follow, and HTTPS will be enforced in this stage, and not by the software provider/vendor.
    – Filipe dos Santos
    Feb 19, 2021 at 17:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .