Skip to content

generate the certificates on install #1

Closed

Description

@mcollina

Shipping the private key is highly insecure, as an attacker can exploit it from the public internet (it happened for webpack).

How about we generate the key on install? or we can store it in the .config folder on the first install and then reuse it.

Activity

  1. watson commented on Dec 3, 2017

    @watson
    Owner

    This tool is only meant for testing and debugging and shouldn't be used in any production code.

    That being said, I'd love if it was possible to just generate a key on the fly. Do you know of any way to do this?

  2. mcollina commented on Dec 7, 2017

    @mcollina
    Author
  3. added a commit that references this issue on Dec 7, 2017
    2a79a16
  4. watson commented on Dec 7, 2017

    @watson
    Owner

    @mcollina awesome, the selfsigned module is just what I was looking for. If you check out PR #2, you can see that I generate a new self-signed cert when the module is required for the fist time. This is different than on install as you suggested. How do you feel about that?

  5. mcollina commented on Dec 7, 2017

    @mcollina
    Author

    That would slow startup down, but it will be very safe!

  6. watson commented on Dec 7, 2017

    @watson
    Owner

    If generated on install time instead, where did you have in mind that the cert and private key should be stored? Inside the node_modules/https-pem folder somewhere?

  7. mcollina commented on Dec 7, 2017

    @mcollina
    Author

    That’d be good, or maybe in ~/.config/https-pem/, so that’s stable across reinstalls.

  8. watson commented on Dec 7, 2017

    @watson
    Owner

    I kind of like that it's self contained and that each installation will generate a new certificate. I've updated the PR to now generate them upon install. Thanks for your help 😃

  9. added a commit that references this issue on Dec 7, 2017
    bafd47e
  10. watson commented on Dec 7, 2017

    @watson
    Owner

    Released as v2.0.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions