Certificate structure for accessing a local device from a web app

Question

I have a pretty standard web app (react client, node server), https-enabled.

I want to add the ability for the web app to access a device on the local LAN. The device has REST APIs and I can install a certificate in it to enable https.

Here's a simplified view of the system:

I have control over my server on the Internet and can install a certificate in the device as well. I can also add records to DNS to add my local device as a subdomain (foo.example.com -> 192.168.X.Y).

I installed a self-signed certificate into the device so I could access it with https, however, my users still have to explicitly navigate to the device's web page and accept the warnings about insecure access before my app's API access will work.

I'd like to be able to set up this device on my network so anyone on the network can access it via my web-hosted app without having to override a security warning.

So the question(s):

1. Is it possible to make this work within the bounds of a standard web app?
2. If so, what certificate/cors configuration would make this possible?

Answer 1

So the short version is that you have a service accessed over TLS where you can deploy a certificate to and you want users to be able to access this without having to click through warnings?

(BTW on Chrome, IME, after explicitly navigating to a site and accepting an insecure certificate, this override times out)

You didn't say why you do not simply install a valid certificate on the device.

A bad solution would be to put a HTTP-to-HTTPS gateway device in front of the target service, configure this ti accept your self-signed certificate for the target device and access the service without TLS.

A better solution, depending on your reasons for not installing a valid certificate on the target device, would be to configure this proxy as a HTTPS-to-HTTPS gateway - presenting a valid certificate to the clients. But if you can get a valid certificate to deploy on the gateway, then you could simply put this on the target device and save on the electricity.

Another solution, although with some organizational costs, is to setup your own certificate authority, deploy the custom CA cert to the clients and a signed certificate to the target device.

You can't solve this with CORS. Any solution which does not invole a certificate creates potential security issues and also a lot of functional complications around scheme mismatches.