How to set up stress-free SSL on an OS X development machine

how-to-set-up-stress-free-ssl-on-os-x.md

How to set up stress-free SSL on an OS X development machine

Install [Homebrew][] if it's not already installed

ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go)"

Resolve a top-level domain for all development work

brew install dnsmasq
mkdir -pv $(brew --prefix)/etc
sudo cp -v $(brew --prefix dnsmasq)/homebrew.mxcl.dnsmasq.plist /Library/LaunchDaemons
sudo launchctl load -w /Library/LaunchDaemons/homebrew.mxcl.dnsmasq.plist
sudo mkdir -pv /etc/resolver

echo "address=/.$(whoami)/127.0.0.1" | sudo tee -a $(brew --prefix)/etc/dnsmasq.conf
echo "nameserver 127.0.0.1" | sudo tee /etc/resolver/$(whoami)

cd /Applications
sleep 1 && open "http://some.domain.$(whoami):9520" &
python -m SimpleHTTPServer 9520

This should open a new browser that shows the contents of your Applications folder. The browser might tell us that the DNS lookup failed. In this case, we'll need to restart the machine to make sure the setup above has taken effect.

Create a wildcard SSL certificate for each project

First, let's create a new directory named for our project and cd into it.

mkdir ~/Desktop/myproject && cd $_

Next, let's create a temporary configuration file, and feed it into openssl to create our certificate.

cat > openssl.cnf <<-EOF
  [req]
  distinguished_name = req_distinguished_name
  x509_extensions = v3_ca
  prompt = no
  [req_distinguished_name]
  CN = *.${PWD##*/}.$(whoami)
  [v3_ca]
  keyUsage = digitalSignature, keyEncipherment
  extendedKeyUsage = serverAuth
  subjectAltName = @alternate_names
  [alternate_names]
  DNS.1 = *.${PWD##*/}.$(whoami)
  DNS.2 = ${PWD##*/}.$(whoami)
EOF

openssl req -new -x509 -newkey rsa:2048 -sha256 -days 3650 -nodes -keyout ${PWD##*/}.key -out ${PWD##*/}.crt -config openssl.cnf

rm openssl.cnf

Avoid HTTPS warnings by telling OS X to trust the certificate

1. Open the certificate in Keychain Access.

open /Applications/Utilities/Keychain\ Access.app ssl.crt

1. Click Don't Trust.

2. Select the newly imported certificate, which should appear at the bottom of the certificate list, and click the [ｉ] button.

3. In the popup window, click the ▶ button to the left of Trust, and select Always Trust for When using this certificate:.

4. Close the popup window.

5. When prompted, enter your password again and click Update Settings.

6. Close Keychain Access.

Bask in easy HTTPS

sleep 1 && open "https://myproject.$(whoami):8443" &
sleep 1 && open "https://subdomain.myproject.$(whoami):8443" &

node <<-EOF
  var https = require("https")
  var fs    = require("fs")

  var options = {
    key: fs.readFileSync("ssl.key"),
    cert: fs.readFileSync("ssl.crt")
  }

  var server = https.createServer(options, function(req, res) {
    res.writeHead(200, {"Content-Type": "text/plain"})
    res.end("It worked!\n")
  })

  server.listen(8443, console.log)
EOF