-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
a1ba10b
commit 0443f98
Showing
10 changed files
with
150 additions
and
89 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,95 +1,23 @@ | ||
# Develop using HTTPS | ||
|
||
To develop locally with HTTPS using a trusted certificate, a possible solution | ||
is to generate a root CA, and a certificate for `localhost` using | ||
[https://github.com/jsha/minica](minica), as recommended by [Let's | ||
Encrypt](https://letsencrypt.org/docs/certificates-for-localhost/). | ||
To develop locally with HTTPS using a trusted certificate, it is recommended to | ||
use [`mkcert`](https://github.com/FiloSottile/mkcert), which _is a simple tool | ||
for making locally-trusted development certificates_. | ||
|
||
> If you want a little more realism in your development certificates, you can | ||
> use minica to generate your own local root certificate, and issue end-entity | ||
> (aka leaf) certificates signed by it. You would then import the root | ||
> certificate rather than a self-signed end-entity certificate. | ||
- Install [`mkcert`](https://github.com/FiloSottile/mkcert) | ||
- Install the root certificates authority (CA) using the `mkcert --install` command | ||
- Generate a certificate for local development using the command: `mkcert localhost 127.0.0.1 ::1` | ||
- Use the feature of the `ASGI` server you select, to run with HTTPS. | ||
For `uvicorn`, refer to this documentation: [https://www.uvicorn.org/deployment/#running-with-https](https://www.uvicorn.org/deployment/#running-with-https). | ||
|
||
Summary: | ||
|
||
1. install [Go](https://golang.org/doc/install) | ||
2. clone the GitHub repository of [minica](https://github.com/jsha/minica) | ||
3. `cd` into the repository's folder and build minica using `go build` as | ||
described in [in `minica` | ||
README](https://github.com/jsha/minica#installation) | ||
4. create certificates for `localhost` using the command below | ||
Example: | ||
|
||
```bash | ||
./minica --domains localhost | ||
``` | ||
|
||
The output from the `minica` repository look like this (under the folder | ||
`localhost`): | ||
|
||
``` | ||
. | ||
├── go.mod | ||
├── LICENSE.txt | ||
├── localhost | ||
│ ├── cert.pem | ||
│ └── key.pem | ||
├── main.go | ||
├── minica | ||
├── minica-key.pem | ||
├── minica.pem | ||
└── README.md | ||
``` | ||
|
||
Then: | ||
mkcert --install | ||
|
||
5. Configure `minica.pem` root certificate as trusted certificate in the system | ||
(see instructions below for Linux and Windows) | ||
6. Run your server using `key.pem` and `cert.pem` generated for localhost | ||
|
||
--- | ||
|
||
### How to configure minica trusted CA | ||
|
||
#### Under Linux | ||
|
||
Configure the given `minica.pem` as trusted CA Authority for your PC. To do so, | ||
install for example `certutil` package, and then use: | ||
|
||
```bash | ||
certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n "minica root" -i minica.pem | ||
``` | ||
mkcert localhost 127.0.0.1 ::1 | ||
|
||
To list existing certificates with `certutil`: | ||
```bash | ||
# list certificates | ||
certutil -L -d sql:${HOME}/.pki/nssdb | ||
``` | ||
|
||
--- | ||
|
||
#### Under Windows | ||
|
||
Use `openssl` to generate a PFX file, from the files generated by `minica`, | ||
using the command below: | ||
|
||
```bash | ||
# Note: this command prompts for a password | ||
openssl pkcs12 -inkey minica-key.pem -in minica.pem -export -out minica.pfx | ||
``` | ||
|
||
Configure the generated PFX as trusted CA Authority for your PC. To do so, | ||
click on the `.pfx` file, and follow the wizard to import the certificate as | ||
Trusted Root Certificate for your machine. | ||
|
||
--- | ||
|
||
Finally, to run using an SSL certificate trusted in the system, for example | ||
with `uvicorn`: | ||
|
||
```bash | ||
uvicorn server:app --reload --ssl-keyfile ./key.pem --ssl-certfile ./cert.pem | ||
uvicorn server:app --port 44555 --ssl-keyfile=./localhost-key.pem --ssl-certfile=./localhost.pem | ||
``` | ||
|
||
Where `key.pem` and `cert.pem` are the files generated for `localhost`. The | ||
development server can now be used at `https://localhost`. Note: | ||
`https://127.0.0.1` won't work in this case. | ||
![Local HTTPS](./img/mkcert-local-https.png) |
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters