53 |
54 | Domain here - DNS service for local IP addresses with TLS/HTTPS
55 | support
56 |
57 |
58 | What is this about
59 | In one of our projects we faced a problem, that we wanted to connect to websocket on a local network from
60 | webpage, that was served from the Internet. In order to use secure web socket connection (wss://) we needed the
61 | SSL certificate, but you can't get one for local IP's. The bottomline was that we could not change client
62 | machines configuration (no /etc/hosts, no importing of own CA's).
63 |
64 | So we came up with the idea, that we could use wildcard SSL certificate and are using
65 | localtls as a DNS server and web server
66 | and Let's Encrypt for wildcard certs.
67 |
68 | Note: In general you should NEVER share the TLS private key as we are on this site. Please read the Security Considerations BEFORE using this service.
69 |
70 | SSL certificate for *.Domain here
71 | The real good news is, you can get from us SSL certificate for domain *.Domain here for free
72 | :) - here it comes:
73 |
80 |
81 |
82 | Disclaimer
83 | This service comes without any guarantee and is provided as-is. We will do our best to keep it working, but we
84 | reserve the right to turn it off anytime and without any reason.
85 |
86 |
94 |
95 |
96 |
97 |
--------------------------------------------------------------------------------
/httpserver.py:
--------------------------------------------------------------------------------
1 | #-*- coding: utf-8 -*-
2 |
3 | import os
4 | import sys
5 | import confs
6 | import cherrypy
7 | import subprocess
8 | import logging
9 | from cherrypy.lib import static
10 |
11 | INDEX_HTML='Hi.'
12 | CERT_PATH='/etc/letsencrypt/live/' + confs.BASE_DOMAIN
13 | logger = logging.getLogger('localtls')
14 |
15 | class Root(object):
16 | @cherrypy.expose
17 | def index(self):
18 | return INDEX_HTML
19 |
20 | @cherrypy.expose
21 | def fullchain(self):
22 | return static.serve_file(os.path.join(CERT_PATH, 'fullchain.pem'), 'application/x-download', 'attachment')
23 |
24 | @cherrypy.expose
25 | def key(self):
26 | return static.serve_file(os.path.join(CERT_PATH, 'privkey.pem'), 'application/x-download', 'attachment')
27 |
28 | @cherrypy.expose
29 | def cert(self):
30 | return static.serve_file(os.path.join(CERT_PATH, 'cert.pem'), 'application/x-download', 'attachment')
31 |
32 | @cherrypy.expose
33 | def chain(self):
34 | return static.serve_file(os.path.join(CERT_PATH, 'chain.pem'), 'application/x-download', 'attachment')
35 |
36 | @cherrypy.expose
37 | @cherrypy.tools.json_out()
38 | def keys(self):
39 | privkey = cert = chain = fullchain = ''
40 | try:
41 | with open(os.path.join(CERT_PATH, 'cert.pem')) as f:
42 | cert = f.read()
43 | with open(os.path.join(CERT_PATH, 'chain.pem')) as f:
44 | chain = f.read()
45 | with open(os.path.join(CERT_PATH, 'fullchain.pem')) as f:
46 | fullchain = f.read()
47 | with open(os.path.join(CERT_PATH, 'privkey.pem')) as f:
48 | privkey = f.read()
49 | except ValueError as e:
50 | cherrypy.log(str(e))
51 | except FileNotFoundError as e:
52 | cherrypy.log(str(e))
53 | except:
54 | cherrypy.log("Unexpected error:", sys.exc_info()[0])
55 | return {'privkey': privkey, 'cert': cert, 'chain': chain, 'fullchain': fullchain}
56 |
57 | @cherrypy.expose
58 | def favicon_ico(self):
59 | raise cherrypy.HTTPError(404)
60 |
61 | def listCertificates():
62 | command = [
63 | 'certbot', 'certificates'
64 | ]
65 | output = subprocess.Popen(command, stdout=subprocess.PIPE, bufsize=1, universal_newlines=True)
66 | current_certificate = ''
67 | current_domain = ''
68 | paths = {}
69 | for line in iter(output.stdout.readline,''):
70 | if line.find('Certificate Name') > -1:
71 | current_certificate = line.split(':')[1].strip()
72 | continue
73 | elif line.find('Domains') > -1:
74 | domains = line.split(':')[1].strip()
75 | current_domain = domains
76 | elif line.find('Certificate Path') > -1:
77 | p = line.split(':')[1].strip()
78 | paths[domains] = os.path.dirname(p)
79 | return paths
80 |
81 | def force_tls(self=None):
82 | # check if url is in https and redirect if http
83 | if cherrypy.request.scheme == "http":
84 | raise cherrypy.HTTPRedirect(cherrypy.url().replace("http:", "https:"), status=301)
85 |
86 | def run(port, index, certpath=''):
87 | global INDEX_HTML, CERT_PATH
88 | try:
89 | with open(index) as f:
90 | INDEX_HTML=bytes(f.read(), "utf8")
91 | except:
92 | pass
93 |
94 | # get certificates
95 | try:
96 | paths = listCertificates()
97 | if ('*.' + confs.BASE_DOMAIN) in paths:
98 | CERT_PATH = paths['*.' + confs.BASE_DOMAIN]
99 | else:
100 | logger.critical("Cannot find wildcard certificate. Run certbotdns.py now and then restart this. Meanwhile HTTP will not work.")
101 | return
102 | except:
103 | logger.critical("Cannot list certificates: {}. Is certbot installed?".format(sys.exc_info()[0]))
104 | #return
105 |
106 | cherrypy.config.update({
107 | 'log.screen': False,
108 | 'log.access_file': '',
109 | 'log.error_file': 'http_error_log',
110 | 'environment': 'production',
111 | 'server.socket_host': '::',
112 | 'server.socket_port': int(port)
113 | })
114 | if port == 443 and confs.BASE_DOMAIN in paths:
115 | logger.info('Starting TLS server.')
116 | cert = paths[confs.BASE_DOMAIN]
117 | cherrypy.tools.force_tls = cherrypy.Tool("before_handler", force_tls)
118 | cherrypy.config.update({
119 | 'server.ssl_module': 'builtin',
120 | 'server.ssl_certificate': os.path.join(cert, "cert.pem"),
121 | 'server.ssl_private_key': os.path.join(cert, "privkey.pem"),
122 | 'server.ssl_certificate_chain': os.path.join(cert, "fullchain.pem"),
123 | 'tools.force_tls.on': True
124 | })
125 |
126 | # extra server instance to dispatch HTTP
127 | server = cherrypy._cpserver.Server()
128 | server.socket_host = '::'
129 | server.socket_port = 80
130 | server.subscribe()
131 |
132 | logger.info('Starting HTTP server.')
133 | cherrypy.quickstart(Root(), '/')
134 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # localtls
2 |
3 | This is a simple DNS server in Python3 to provide TLS to webservices on local addresses. In short, it resolves addresses such as `192-168-0-1.yourdomain.net` to `192.168.0.1` and has a valid TLS certificate for them.
4 |
5 | This was written to circumvent the problem that current browsers require a secure context for a number of operations, such as opening the camera with `getUserMedia`, but the web service is running on a local network, where it is difficult to get a certificate or handling the local DNS servers is difficult or impossible (aham users aham). It can also be used to easily develop and debug web applications that require secure contexts other than in localhost.
6 |
7 | Technically it's a very simple DNS server written in Python, which uses [Let's Encrypt](https://letsencrypt.org/) to generate a wildcard certificate for *.yourdomain.net on a real public server. This certificate, both private and public keys, is available for download via both a `REST` call as well as two `GET` calls on a simple HTTP server, also provided.
8 |
9 | ## Technical explanation and motivation
10 |
11 | Browsers require