1

I have a website (http://example.com) which makes some requests to http://localhost:12345 in its javascript. I want to open this website over https but due to mixed content some browsers throw warnings.

How much security issue would it be if I buy a separate cert for localhost.example.com and point the dns to 127.0.0.1 and then use it for the requests made by javascript? Essentially the cert will be installed on a server at client's end. As far as I understand, even if someone has the certificate for localhost.example.com, the requests for *.example.com cannot be decrypted with it. Am I right with this thought?

Also how does CAs act in this case? Would they take any action on their own without our concent?

  • 1
    So the pages served by this site reference both server-hosted content and from the sounds of it, content hosted by the requester itself. Is that correct? – sysadmin1138 Mar 11 '14 at 11:49
  • @sysadmin1138 yes. You are right. – Aditya Patawari Mar 11 '14 at 15:03
1

To secure a local endpoint on the requesters computer using an SSL certificate, you would need to distribute both the private and public key to your client computers, and make sure that the local application listening on 127.0.0.1:12345 uses this key pair.

From an attackers point of view, the interception of messages routed towards 127.0.0.1/8 would require privileged local access to the client computer (as loopback traffic never "leaves" the machine)

If a potential attacker already has the privileged access needed to eavesdrop on local tcp sockets, then that attacker probably also has or can gain access to the private key, rendering your efforts futile.

Furthermore - now that message encryption is relying on the same key no matter where you are, compromising one client computer now compromises the encryption key on all client computers.

There are a number of ways of ensuring inter-process message encryption, but distributing an SSL certificate from a public CA along with its private key is definitely not a viable starting point.

  • I get that data at 127.0.0.1 has high chances of getting compromised. Would it put the data hosted by the server also in jeopardy? – Aditya Patawari Mar 11 '14 at 15:09
  • If you use the same certificate to encrypt and authenticate both connections, then yes. Otherwise, no – Mathias R. Jessen Mar 11 '14 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.