|
4 | 4 | <meta charset="UTF-8"> |
5 | 5 | <meta name="viewport" content="width=device-width,initial-scale=1"> |
6 | 6 | <meta name="turbo-root" content="/wp-packages"> |
7 | | - <meta name="turbo-cache-control" content="no-cache" data-turbo-track="reload" data-track-token="3.6.0.790172063425"> |
| 7 | + <meta name="turbo-cache-control" content="no-cache" data-turbo-track="reload" data-track-token="3.6.0.790248043674"> |
8 | 8 |
|
9 | 9 | <!-- See retype.com --> |
10 | 10 | <meta name="generator" content="Retype 3.6.0"> |
|
31 | 31 |
|
32 | 32 | <script data-cfasync="false">(function () { var el = document.documentElement, m = localStorage.getItem("doc_theme"), wm = window.matchMedia; if (m === "dark" || (!m && wm && wm("(prefers-color-scheme: dark)").matches)) { el.classList.add("dark") } else { el.classList.remove("dark") } })();</script> |
33 | 33 |
|
34 | | - <link href="../../../resources/css/retype.css?v=3.6.0.790172063425" rel="stylesheet"> |
| 34 | + <link href="../../../resources/css/retype.css?v=3.6.0.790248043674" rel="stylesheet"> |
35 | 35 |
|
36 | | - <script data-cfasync="false" src="../../../resources/js/config.js?v=3.6.0.790172063425" data-turbo-eval="false" defer></script> |
| 36 | + <script data-cfasync="false" src="../../../resources/js/config.js?v=3.6.0.790248043674" data-turbo-eval="false" defer></script> |
37 | 37 | <script data-cfasync="false" src="../../../resources/js/retype.js?v=3.6.0" data-turbo-eval="false" defer></script> |
38 | | - <script id="lunr-js" data-cfasync="false" src="../../../resources/js/lunr.js?v=3.6.0.790172063425" data-turbo-eval="false" defer></script> |
39 | | - <script id="prism-js" data-cfasync="false" src="../../../resources/js/prism.js?v=3.6.0.790172063425" defer></script> |
| 38 | + <script id="lunr-js" data-cfasync="false" src="../../../resources/js/lunr.js?v=3.6.0.790248043674" data-turbo-eval="false" defer></script> |
40 | 39 | </head> |
41 | 40 | <body> |
42 | 41 | <div id="docs-app" class="relative text-base antialiased text-gray-700 bg-white font-body dark:bg-dark-850 dark:text-dark-300"> |
@@ -165,70 +164,8 @@ <h2> |
165 | 164 | <span>Using a local certificate authority (CA)</span> |
166 | 165 | </h2> |
167 | 166 | </doc-anchor-target> |
168 | | -<p><a href="https://web.dev/how-to-use-local-https/">The general recommended approach for not relying on self-signed certificates is to set up a local CA</a>. There are several tools for doing this, but perhaps the easiest is <a href="https://github.com/FiloSottile/mkcert">mkcert</a>.</p> |
169 | | -<p>Before some basic instructions for setting this up, here is some information/disclaimer:</p> |
170 | | -<p><strong>Installing a local CA is at your own risk. Although it will only be trusted by you, a local CA will contaminate your trusted CAs. This means, if your local environment is compromised, or mkcert, then your entire HTTPS trust chain can easily be compromised too. It is for this reason we do not set this up by default and cannot recommend this approach.</strong></p> |
171 | | -<p>If you're comfortable with all that and still want to go ahead, here's how you can do it with mkcert.</p> |
172 | | -<doc-anchor-target id="install-mkcert"> |
173 | | - <h3> |
174 | | - <doc-anchor-trigger class="header-anchor-trigger" to="#install-mkcert">#</doc-anchor-trigger> |
175 | | - <span>Install mkcert</span> |
176 | | - </h3> |
177 | | -</doc-anchor-target> |
178 | | -<p>On Mac:</p> |
179 | | -<div class="codeblock-wrapper"><doc-codeblock> |
180 | | -<pre class="language-bash"><code v-pre class="language-bash">brew install mkcert |
181 | | -brew install nss # if you use Firefox</code></pre> |
182 | | -</doc-codeblock></div> |
183 | | -<p>For other platforms see: <a href="https://github.com/FiloSottile/mkcert#installation">https://github.com/FiloSottile/mkcert#installation</a></p> |
184 | | -<doc-anchor-target id="add-mkcert-to-your-local-root-cas"> |
185 | | - <h3> |
186 | | - <doc-anchor-trigger class="header-anchor-trigger" to="#add-mkcert-to-your-local-root-cas">#</doc-anchor-trigger> |
187 | | - <span>Add mkcert to your local root CAs</span> |
188 | | - </h3> |
189 | | -</doc-anchor-target> |
190 | | -<div class="codeblock-wrapper"><doc-codeblock> |
191 | | -<pre class="language-bash"><code v-pre class="language-bash">mkcert -install</code></pre> |
192 | | -</doc-codeblock></div> |
193 | | -<doc-anchor-target id="generate-a-certificate"> |
194 | | - <h3> |
195 | | - <doc-anchor-trigger class="header-anchor-trigger" to="#generate-a-certificate">#</doc-anchor-trigger> |
196 | | - <span>Generate a certificate</span> |
197 | | - </h3> |
198 | | -</doc-anchor-target> |
199 | | -<div class="codeblock-wrapper"><doc-codeblock> |
200 | | -<pre class="language-bash"><code v-pre class="language-bash">mkcert my-project.local -cert-file docker/nginx/local_https_cert.pem -key-file docker/nginx/local_https_key.pem # Change the host accordingly</code></pre> |
201 | | -</doc-codeblock></div> |
202 | | -<doc-anchor-target id="update-docker-config"> |
203 | | - <h3> |
204 | | - <doc-anchor-trigger class="header-anchor-trigger" to="#update-docker-config">#</doc-anchor-trigger> |
205 | | - <span>Update docker config</span> |
206 | | - </h3> |
207 | | -</doc-anchor-target> |
208 | | -<p>Add the following volumes to the <code v-pre>nginx</code> container within <code v-pre>docker-compose.yml</code></p> |
209 | | -<div class="codeblock-wrapper"><doc-codeblock> |
210 | | -<pre class="language-yaml"><code v-pre class="language-yaml">- './docker/nginx/local_https_cert.pem:/etc/pki/tls/certs/local_https_cert.pem:delegated' |
211 | | -- './docker/nginx/local_https_key.key:/etc/pki/tls/private/local_https_key.key:delegated'</code></pre> |
212 | | -</doc-codeblock></div> |
213 | | -<p>Update <code v-pre>docker/nginx/conf/app.conf</code> to point to your certificate and key:</p> |
214 | | -<div class="codeblock-wrapper"><doc-codeblock> |
215 | | -<pre class="language-ini"><code v-pre class="language-ini">ssl_certificate /etc/pki/tls/certs/local_https_cert.pem; |
216 | | -ssl_certificate_key /etc/pki/tls/local_https_key.pem;</code></pre> |
217 | | -</doc-codeblock></div> |
218 | | -<doc-anchor-target id="rebuild-containers"> |
219 | | - <h3> |
220 | | - <doc-anchor-trigger class="header-anchor-trigger" to="#rebuild-containers">#</doc-anchor-trigger> |
221 | | - <span>Rebuild containers</span> |
222 | | - </h3> |
223 | | -</doc-anchor-target> |
224 | | -<p><code v-pre>docker-compose stop; docker-compose build; docker-compose up</code></p> |
225 | | -<doc-anchor-target id="any-other-options"> |
226 | | - <h2> |
227 | | - <doc-anchor-trigger class="header-anchor-trigger" to="#any-other-options">#</doc-anchor-trigger> |
228 | | - <span>Any other options?</span> |
229 | | - </h2> |
230 | | -</doc-anchor-target> |
231 | | -<p>There are, this page from the chromium site lists a few other things you might want to try also: <a href="https://www.chromium.org/Home/chromium-security/deprecating-powerful-features-on-insecure-origins#TOC-Testing-Powerful-Features">https://www.chromium.org/Home/chromium-security/deprecating-powerful-features-on-insecure-origins#TOC-Testing-Powerful-Features</a></p> |
| 167 | +<p>You should not use a local certificate authority to have a signed certificate that is validated. A local CA will contaminate your trusted CAs. This means, if your local environment is compromised, or mkcert, then your entire HTTPS trust chain can easily be compromised too. It is for this reason we do not set this up by default and cannot recommend this approach.</p> |
| 168 | +<p>If you require a trusted local certificate, you should raise this with your project lead to outline the reasons for the requirements and discuss potential solutions. Setting up a local CA should be considered a last resort, though documented solutions to do this are easily found online you should carefuly consider the risks.</p> |
232 | 169 |
|
233 | 170 |
|
234 | 171 | <!-- Required only on API pages --> |
|
295 | 232 |
|
296 | 233 | <div id="docs-overlay-target"></div> |
297 | 234 |
|
298 | | - <script data-cfasync="false">window.__DOCS__ = { "title": "HTTPS", level: 3, icon: "file", hasPrism: true, hasMermaid: false, hasMath: false, tocDepth: 23 }</script> |
| 235 | + <script data-cfasync="false">window.__DOCS__ = { "title": "HTTPS", level: 3, icon: "file", hasPrism: false, hasMermaid: false, hasMath: false, tocDepth: 23 }</script> |
299 | 236 | </body> |
300 | 237 | </html> |
0 commit comments