ssl

Create a certificate

openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout ~/git/key.pem -out ~/git/cert.pem

Current directory:

npx http-server -S --cors -C ~/git/cert.pem -K ~/git/key.pem -o --port 3001

A specific directory:

npx http-server my-directory -S --cors -C ~/git/cert.pem -K ~/git/key.pem -o --port 3001

• Demystify http.sys with HttpSysManager by Nicolas Dorier

1. Download the certificate authority certificate: myCA.pem
2. Settings > Security > Encryption and credentials > Install a certificate > CA certificate

Add certificate authority

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/myCA.pem

Display the subjectAltName of a certificate:

openssl x509 -noout -ext subjectAltName -in ./keys/cert.pem

Convert to pfx:

openssl pkcs12 -export -out ./keys/myCA.pfx -inkey ./keys/myCA.key -in ./keys/myCA.pem

Create a CA signed certificate:

openssl genrsa -out linkninja.key
openssl req -new -key linkninja.key -out linkninja.csr -config linkninja.cnf
openssl x509 -req -in linkninja.csr -CA myCA.pem -CAkey myCA.key -CAcreateserial -out linkninja.pem -sha256 -extfile linkninja.cnf -extensions req_ext

Installed certificates expiring? Use X509KeyStorageFlags.PersistKeySet - What is the impact of PersistKeySet

bind a certificate

netsh http add sslcert ipport=<ipAddress>:<port> ^
    certhash={<certificateThumbprint>} appid={<someGuid>}

check current bindings

# all
netsh http show sslcert
# single ip/port
netsh http show sslcert ipport=<ipAddress>:<port>

remove binding

netsh http delete sslcert ipport=<ipAddress>:<port>

errors

When attempting to bind, the following error might occur;

A specified logon session does not exist. It may already have been terminated.

This means a private key needs to be attached to the certificate prior to binding.

Add certificate authority

Via administrator session

certutil -addstore "CA" .\SomeCertAuthority.pem

Add -f to force replace if the cert already exists

1. Download the certificate authority certificate: myCA.pem
2. Tap install
3. Settings > General > Device Managemnet > Install the cert
4. Settings > General > About > Certificate Trust Settings > Enable the cert

See more

ServicePointManager.ServerCertificateValidationCallback += 
  new RemoteCertificateValidationCallback(ValidateCertificate);

public static bool ValidateCertificate(object sender, X509Certificate cert, 
  X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
      return true;
}