0

I have a pretty standard web app (react client, node server), https-enabled.

I want to add the ability for the web app to access a device on the local LAN. The device has REST APIs and I can install a certificate in it to enable https.

Here's a simplified view of the system:

enter image description here

I have control over my server on the Internet and can install a certificate in the device as well. I can also add records to DNS to add my local device as a subdomain (foo.example.com -> 192.168.X.Y).

I installed a self-signed certificate into the device so I could access it with https, however, my users still have to explicitly navigate to the device's web page and accept the warnings about insecure access before my app's API access will work.

I'd like to be able to set up this device on my network so anyone on the network can access it via my web-hosted app without having to override a security warning.

So the question(s):

  1. Is it possible to make this work within the bounds of a standard web app?
  2. If so, what certificate/cors configuration would make this possible?
1
  • 1
    It seems that your problem boils down to running HTTPS on an internal LAN. There are inherent challenges in doing this, especially when it comes to the certificates for securing the HTTPS connections. See security.stackexchange.com/questions/121163/… for some interesting reading on this subject.
    – mti2935
    Jul 31 at 19:15

1 Answer 1

0

So the short version is that you have a service accessed over TLS where you can deploy a certificate to and you want users to be able to access this without having to click through warnings?

(BTW on Chrome, IME, after explicitly navigating to a site and accepting an insecure certificate, this override times out)

You didn't say why you do not simply install a valid certificate on the device.

A bad solution would be to put a HTTP-to-HTTPS gateway device in front of the target service, configure this ti accept your self-signed certificate for the target device and access the service without TLS.

A better solution, depending on your reasons for not installing a valid certificate on the target device, would be to configure this proxy as a HTTPS-to-HTTPS gateway - presenting a valid certificate to the clients. But if you can get a valid certificate to deploy on the gateway, then you could simply put this on the target device and save on the electricity.

Another solution, although with some organizational costs, is to setup your own certificate authority, deploy the custom CA cert to the clients and a signed certificate to the target device.

You can't solve this with CORS. Any solution which does not invole a certificate creates potential security issues and also a lot of functional complications around scheme mismatches.

3
  • I guess I'm not sure what a valid certificate would be for the target device. I installed a self-signed cert, which is what the browser seems to not like. I use Let's Encrypt for my web certs and I am able to create certs for *.example.com with. Maybe I could grab that cert, but LE wants to renew them every few months, so anything not automated would be a pain to maintain.
    – Jim B.
    Aug 1 at 20:49
  • "so anything not automated" - use certbot or one of the MANY other ACME implementations. Its a no-brainer.
    – symcbean
    Aug 1 at 23:21
  • Yeah, I mean I have to automate installing the cert in the device, but it's doable.
    – Jim B.
    Aug 2 at 1:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .