moOde and HTTPS

[ubergoober]

Since the Moode player is not a certificate authority, it should not pretend to be.  It should have an identity certificate signed by a known and trusted CA.  Anybody operating strictly within their own private home network should not care.  

If you are going to the trouble of exposing it to the internet, then there isn't any reason you could not use an ACME client script to get a free cert from LetsEncrypt.  If you don't want your player exposed full time, you can tell your router that the ip address of the player is the DMZ host allowing full access while you generate or renew your cert.  
The Letsencrypt CA cert is already included in windows, linux, ios and android.  Wrapping a script around the acme client should allow you to place the ID cert in the correct place and use it for the REST API.

Interesting argument.

It seems to me that  a  "private home network" is exactly the point here. AIUI, the motivation for developing the experimental HTTPS mode is to deal with the trend in web browsers to make  it increasingly cumbersome to access a HTTP server, even though it is operating within a private home network.

I can't speak for @Tim Curtis but personally I don't believe a moOde player should be "exposed" to the internet except from behind a home router with full NAT in play and no port forwarding. 

As for Let's Encrypt I have no experience with it or the ACME client script (I haven't spun up a public-facing server in a over a decade and have had no need for their free service). Without experimenting, I can't comment on the practicality of this proposal in a moOde player and a home environment.

Regards,
Kent

It's not very hard.  Here's their getting started page https://letsencrypt.org/getting-started/ .  Whether your motivation for using SSL is dealing with modern browsers and their ever increasing restrictions or if you're operating Moode in a less than private network, let's say a college dorm, your company WiFi network or yes, heaven forbid, the open internet, you will need an identity cert trusted by a CA that's preferably already built into your device.  It just makes life easier when you use these tools in a manner consistent with their design.

[Tim Curtis]

Since the Moode player is not a certificate authority, it should not pretend to be.  It should have an identity certificate signed by a known and trusted CA.  Anybody operating strictly within their own private home network should not care.  
If you are going to the trouble of exposing it to the internet, then there isn't any reason you could not use an ACME client script to get a free cert from LetsEncrypt.  If you don't want your player exposed full time, you can tell your router that the ip address of the player is the DMZ host allowing full access while you generate or renew your cert.  
The Letsencrypt CA cert is already included in windows, linux, ios and android.  Wrapping a script around the acme client should allow you to place the ID cert in the correct place and use it for the REST API.

The HTTPS mode feature is for local network only and not for connecting a moOde host directly to the Internet which has never been supported because it's insecure in many ways other than whether or not HTTPS is used. 

To run HTTPS on a local network you either have to generate self-signed certs or run a local Certificate Authority (CA) to generate and sign certs with its private key. The HTTPS mode feature in moOde uses self-signed certs because obviously users can't be expected to install and administer a local CA server on their network.

Self-signed certs are easy to automatically generate and install into the web server but challenging to install on the client OS because its a manual process, and it differs depending on the OS.

Self-signed certs store their private keys locally on the computer running the web server which in our case is the Raspberry Pi running moOde. AFAIK it doesn't matter whether the cert is marked as a CA or not. What matters is keeping the private key secure.

In any case HTTPS mode is an experimental feature and we'll just have to see what shakes out.

[ubergoober]

Since the Moode player is not a certificate authority, it should not pretend to be.  It should have an identity certificate signed by a known and trusted CA.  Anybody operating strictly within their own private home network should not care.  
If you are going to the trouble of exposing it to the internet, then there isn't any reason you could not use an ACME client script to get a free cert from LetsEncrypt.  If you don't want your player exposed full time, you can tell your router that the ip address of the player is the DMZ host allowing full access while you generate or renew your cert.  
The Letsencrypt CA cert is already included in windows, linux, ios and android.  Wrapping a script around the acme client should allow you to place the ID cert in the correct place and use it for the REST API.

The HTTPS mode feature is for local network only and not for connecting a moOde host directly to the Internet which has never been supported because it's insecure in many ways other than whether or not HTTPS is used. 

To run HTTPS on a local network you either have to generate self-signed certs or run a local Certificate Authority (CA) to generate and sign certs with its private key. The HTTPS mode feature in moOde uses self-signed certs because obviously users can't be expected to install and administer a local CA server on their network.

Self-signed certs are easy to automatically generate and install into the web server but challenging to install on the client OS because its a manual process, and it differs depending on the OS.

Self-signed certs store their private keys locally on the computer running the web server which in our case is the Raspberry Pi running moOde. AFAIK it doesn't matter whether the cert is marked as a CA or not. What matters is keeping the private key secure.

In any case HTTPS mode is an experimental feature and we'll just have to see what shakes out.

As you wish.