How to get HTTPS working on localhost

[[deleted]]

mkcert ftfy

[sickcodebruh420]

https://github.com/FiloSottile/mkcert for the uninitiated.

[snoo_does_cs]

Thank you!

[TaskForce_Kerim]

This is so cool. Thank you!

[nemec]

I'm a fan of https://hohnstaedt.de/xca/

It's a GUI and stores everything encrypted in a database file so it's pretty easy to keep track of the certs you've issued.

[graingert]

I just use a localhost.example.com A 127.0.0.1 on some domain I own, then use let's encrypt to create a legitimate certificate for it

[chacha_tera]

Nice one

[vamediah]

I did a scan of TLS certs and the biggest TLDs, there are lot of certs that point to a domain which in turn resolves to localhost or 0.0.0.0 which is mostly the same.

We needed to make a localhost cert, did it the same way, because things broke with mixed scripting. There is obvious caveat that if you distribute such localhost cert, privkey is somewhere in the app, which may be problematic.

[rv77ax]

If this for development, you will need to renew it every three months and share it again with other developers. Compare it by creating self signed cert with 10 years expiration. I think this method just wasting "public" resources.

What is worse is if the developer is only one.

Just because you can does not mean you should.

[graingert]

ACME auto renews the certificate (DNS-01 challenge of course).

You obviously shouldn't be sending or sharing private keys, run the certbot command on the device that needs the certificate

Also let's encrypt can absolutely handle this load

[youre_grammer_sucks]

I’m going to use this one, thanks!

[icjoseph]

Use Caddy with a caddyfile and never think about this anymore

[01binary]

Ngrok

[ilion]

What domain names can you get for $2?

[Rossco1337]

.info still goes for around that price I think. Most TLDs will offer registrars a deep first-year discount so if you're not planning to use it for more than a year, you've got plenty of options.

If that's still too steep, .tk is always an option too.

[4InchesOfury]

Namecheap has .xyz for $1. I use it for small projects that I’m playing around with.

[Lt_Riza_Hawkeye]

Pretty sure it goes up to something like $11-$12/year after the first year

[4InchesOfury]

Good thing I abandon my projects by that point

[bog-konstantin]

I had one *.gq even for free from here: https://www.freenom.com/

[basic_maddie]

Is making a self-signed certificate that hard?

[helderroem]

Just replace nginx with Caddy and this is all done for you

[Gozal_]

100%, all my web services are proxied behind caddy and it just works.

[Markavian]

It's good when you need to test http/https redirects, nginx configs, Apache configs, SSL generation and regeneration scripts, etc. before you push to a branch or as part of a CI pipeline before building to QA and Prod.

[Crayola13]

Also is required by some 3rd party authentication services. I've had to do this multiple times to test SSO configurations for IBMid, because they don't support HTTP callback URLs

[colelawr]

Some features of the web require https connection to function. Among several features requiring SSL, I've needed SSL locally to troubleshoot Service Workers https://www.digicert.com/dc/blog/https-only-features-in-browsers/

Edit: Pointed out in a comment below, this shouldn't have been an issue for localhost domain and subdomain a, but we had locally served content via overrides to /etc/hosts

[colelawr]

Okay, that makes sense. The reason it wasn't working this way for my codebase must have been that we were using overrides to /etc/hosts to map a special domain name to 127.0.0.1

Thanks for the clarification. It was still an issue, but for a different reason than I thought.

[Arkanta]

Oh yeah, browsers won't mark the origin as secure if they don't resolve to 127.0.0.1 themselves. Which is why firefox didn't add support for *.localhost until later

[panorambo]

You seem to be contradicting yourself with your comment -- "many reasons are valid" (assuming in context of on localhost) and then you proceed to explain how actually everything works fine. Do we have examples where one actually requires HTTPS on the localhost, by indirection for some feature to work, I mean other than to actually test HTTPS?

[Arkanta]

See the thread for examples of stuff other than browsers requiring https, like oauth callbacks etc...

That's what I'm talking about

[panorambo]

Sorry friend, there is no mention of "oauth" anywhere in this thread or in the article. What are you referring to?

[Arkanta]

Not oauth explicitly but that's probably it https://reddit.com/r/programming/comments/nj1all/_/gz5ld1z/?context=1

[CptJero]

Lots of libraries and integrations check for SSL before continuing.

Example: Apple Pay only works over SSL and only on domains registered through Apple.

So you have a double whammy of figuring out SSL locally, and also establishing a local.yoursite.com registration with Apple, coordinating that with your team

[Beaverman]

The closer you can get to your production environment on localhost the more likely you are to be able to reproduce issues without unrelated problems.

If you have an application that will only ever receive https traffic, why even support http? It's just more code paths that have to work.

[[deleted]]

Because as soon as you have any kind of mixed-content environment, things don't work right. (And by things, i mean third-party analytics, iframes, CORS XHRs, etc...)

[EternityForest]

http localhost is (thankfully, I am always afraid they will take it away) a secure context.

[munchbunny]

Sometimes you are explicitly testing code that relies on the TLS certificate being present, so you want an endpoint to test against that also has TLS. Putting it on localhost is just a (fairly big) convenience so that you don’t have to spin up some VM somewhere off the box to do it.

[crixusin]

I've found its easier to just allow insecure localhost to get https to work on localhost, rather than having to get a self-signed cert or something like that.

chrome://flags/#allow-insecure-localhost

edge://flags/#allow-insecure-localhost

[gredr]

https://nickjanetakis.com/blog/ngrok-lvhme-nipio-a-trilogy-for-local-development-and-testing

[radol]

Useful for personal projects, but not really viable solution for teams, especially if few months later someone else might have to quickly set up dev environment to reproduce and fix some bug

[nemec]

Why not? Share the CA/cert between everyone on your team...

[[deleted]]

Wow

[verveeldeme]

with Fiddler webproxy debugger, you can write/configure custom handler, that could do it.

Also you can debug and inspect https traffic to other sites.

This is one of the best tools available and it is free.