1

I am developing a web application which will be downloaded, installed and used by my customers on their intranet. The data in the application is confidential, so all requests and responses need to be encrypted. What is the best way to accomplish this?

I have two goals: (1) privacy of data and (2) ease-of-use.

I am familiar with self-signed certificates. But browsers are not friendly to self-signed certificates. They display scary warnings. Of late self-signed certificates have become harder to use. Chrome requires the user to type "this is unsafe" to go to the site.

You can't use a real certificate either, because real certificates are only granted to real domains. You could edit the hosts file of the PC to point a real domain to an intranet server, then you could use a real certificate. But this is hard for customers. (And impossible if they have ChromeBooks and no DNS servers.)

SSL was invented in 1994, and now it is 2021. Surely this is a solved problem?

2
  • 4
    Would installing a custom CA root cert on all browsers/computers be difficult for them to configure? We have to assume your client have some tech staff, or else there can be no ease.
    – DannyNiu
    Mar 1, 2021 at 5:05
  • Agreed, a custom CA is the way to go. The unsolved problem there is that there's no way to limit what domains a custom CA can sign, so custom CAs aren't well-liked since they could allow backdooring of all internet traffic. Mar 1, 2021 at 14:28

1 Answer 1

3

SSL was invented in 1994, and now it is 2021. Surely this is a solved problem?

Surely SSL/TLS had evolved into something much more secure, with stakeholders such as IETF TLS working group, CA/B forum, browser vendors, etc. being more sophiscated at securing the connections for ordinary users.

There is one possible solution for your customers. With this solution, you don't have to mass-install certificates on all machines, but you do have to periodically pay for some ISP service.

  1. Get a public domain name, and a certificate for it,

  2. Resolve the domain name to your private intranet server address.

That's obviously less painful to configure individual computers, but nonetheless require a technical staff to setup the server.

Additionally, per advice from my CA provider, setting up OCSP stapling on the server can improve performance when browsers verifies the validity of the certificate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .