HTTPS is the way #206
HTTPS is the way #206
Conversation
| var certOpts = { | ||
| installCertutil: true | ||
| } | ||
| var certName = entry.replace(new RegExp(path.sep, 'g'), '-').slice(-64) |
There was a problem hiding this comment.
The certname should be unique for each project (maybe per entry point?) -- but there's a 64 character limit on it due to ASN1:
↳ openssl req -config /Users/todd/.config/devcert/openssl.conf -subj "/CN=-Users-todd-src-showrunner-node_modules-@scriptollc-code-mirror-ot-standalone.js" -key /Users/todd/.config/devcert/-Users-todd-src-showrunner-node_modules-@scriptollc-code-mirror-ot-standalone.js.key -out /Users/todd/.config/devcert/-Users-todd-src-showrunner-node_modules-@scriptollc-code-mirror-ot-standalone.js.csr -new
problems making Certificate Request
4550:error:0D07A097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-64.50.6/src/crypto/asn1/a_mbstr.c:154:maxsize=64
There was a problem hiding this comment.
So we have to verify that we only ever pass in 64 characters. If you try to pass in with path separators, it fails as well since the cert name has the directory name attached, and that directory doesn't exist (which might be a bug in devcert).
|
We might also want to wait for: To land (if they do) since we can stop doing the data manipulation and let it occur upstream (which feels more proper). |
|
Ohey, yeah alternatively we could just use https://github.com/Dexus/pem - it's what |
|
Closed in favor of #217 |
That
.defaultthing caught me for a minute. Really wish there was betterinterop between cjs and ecmascript modules... Not sure if the
.defaultisbetter on the require (so the API works as "expected" w/r/t to cjs) or if you
want
devCert.default()when invoking it.Plus the
{installCertutil: true}option doesn't seem to work on my mac at thevery least, as chrome and firefox still give security warnings?
Lastly should we be only HTTPS or HTTP by default with HTTPS opt-in or HTTPS
by default or HTTP opt-in
I figure if we can get this working on multiple platforms without security
issues there's no reason not to do HTTPS-only?