[{"data":1,"prerenderedAt":57},["ShallowReactive",2],{"$f1lbuff8pmaejc":3,"recommended":26},{"title":4,"path":5,"date":6,"updated":7,"tags":8,"excerpt":11,"readingMinutes":12,"commentCount":13,"html":14,"comments":15,"next":20,"prev":23},"A secure home gateway on the Raspberry Pi in four parts. Part three, free HTTPS to the rescue","\u002F2012\u002F10\u002Fa-secure-home-gateway-on-raspberry-pi_3759\u002F","2012-10-14T08:56:00.003Z","2012-10-14T20:32:56.200Z",[9,10],"hardware","how-to","I have some very nifty devices lying around in my home: A couple of computers A very smart router with the Tomato firmware A Raspberry Pi model B (the only one you can get right now) A Popcorn Hour A200 Besides that, I…",3,1,"\u003Cp>I have some very nifty devices lying around in my home:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>A couple of computers\u003C\u002Fli>\n\u003Cli>A very smart router with the Tomato firmware\u003C\u002Fli>\n\u003Cli>A Raspberry Pi model B (the only one you can get right now)\u003C\u002Fli>\n\u003Cli>A Popcorn Hour A200\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Besides that, I have full control over a domain name (waleson.com.).\u003C\u002Fp>\n\u003Cp>The amount of cool things you can do with this is enormous. However, until yesterday morning, these devices were working with most of their default settings (BOOOORING). Here's how I made it awesome in one evening.\u003C\u002Fp>\n\u003Ch2>Part three, free HTTPS to the rescue\u003C\u002Fh2>\n\u003Col>\n\u003Cli>Part one - \u003Ca href=\"\u002F2012\u002F10\u002Fa-secure-home-gateway-on-raspberry-pi\u002F\">Dynamic DNS\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>Part two - \u003Ca href=\"\u002F2012\u002F10\u002Fa-secure-home-gateway-on-raspberry-pi_14\u002F\">nginx on the Raspberry Pi\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>\u003Cem>Objective: You want to wear protection before we take this to the next level\u003C\u002Fem>\u003C\u002Fp>\n\u003Cp>Congratulations to you all, you now have a working http server on the RaspberryPi in your home, accessible from a nice url. Sure, it's not fast, and only serves static pages, but that doesn't matter.\u003C\u002Fp>\n\u003Cp>I said earlier that opening up your router's web interface over http to the entire internet was a bad idea. Eavesdroppers are able to see your credentials and do all kinds of nasty stuff to your router. However, having access to your router from the outside would be very useful! And this is just one of the many cool things you want to do that requires authentication and security. We need an encrypted connection.\u003C\u002Fp>\n\u003Cp>As many of you will now, \u003Ca href=\"https:\u002F\u002Fwww.startssl.com\u002F\">StartSSL\u003C\u002Fa> offers free SSL certificates to natural persons. I happen to be just that. This is absolutely fantastic. I went the the express lane on their site, filled out my info, and selected to create a certificate for waleson.com. I already had a paid SSL certificate for that, but you can select one additional subdomain in the class one certificate that you get for free. For my paid certificate I chose waleson.com and subdomain www.waleson.com.\u003C\u002Fp>\n\u003Cp>For this new certificate I chose waleson.com and home.waleson.com. (I'm not going to use it for waleson.com, I just want the subdomain here).\u003C\u002Fp>\n\u003Cp>Somewhere in the process you can create your own private key for which you need a passphrase. I created a random passphrase and put it in my password safe. Out of the StartSSL express lane, you end up with two files: the certificate (ssl.crt) and the key (ssl.key). You need to download two more: ca.pem and sub.class1.server.ca.pem from \u003Ca href=\"https:\u002F\u002Fca.startssl.com\u002Fcerts\u002F\">https:\u002F\u002Fca.startssl.com\u002Fcerts\u002F\u003C\u002Fa>. Move all of these files to a location on the Raspberry Pi. Let's say \u002Fusr\u002Flocal\u002Fetc\u002Fssl. Do this:\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>cd \u002Fusr\u002Flocal\u002Fetc\u002Fssl\ncat ca.pem sub.class1.server.ca.pem ssl.crt > crt.pem\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>This will create a certificate chain, from the root certificate of StartCOM to their intermediate certificate and then down to our certificate. We'll present this entire chain to the clients, so we conCATenate all these certificates into one large certificate chain file.\u003C\u002Fp>\n\u003Cp>Now, in nginx, let's configure the server section (\u002Fetc\u002Fnginx\u002Fsites-enabled\u002Fhome.waleson.com.conf) once more.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>server {\nlisten 80;\nrewrite ^(.*) \u003Ca href=\"https:\u002F\u002F$host$1\">https:\u002F\u002F$host$1\u003C\u002Fa> permanent;\n}\nserver {\nserver_name home.waleson.com;\nlisten 443 ssl;\nerror_log \u002Fvar\u002Flog\u002Fnginx\u002Fhome.error;\naccess_log \u002Fvar\u002Flog\u002Fnginx\u002Fhome.access;\nssl on;\nssl_certificate \u002Fusr\u002Flocal\u002Fetc\u002Fssl\u002Fcrt.pem;\nssl_certificate_key \u002Fusr\u002Flocal\u002Fetc\u002Fssl\u002Fssl.key;\nroot \u002Fsrv\u002Fwww;\nindex index.html \u002Findex.html;\n}\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>To everyone connecting on port 80 we say: "No way man. Be secure. Connect on port 443 and you'd better remember it, forever!"\u003C\u002Fp>\n\u003Cp>Now when we try to restart the server:\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\u002Fetc\u002Finit.d\u002Fnginx restart\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>we'll get asked for the passphrase because the server needs to access the private key.\u003C\u002Fp>\n\u003Cp>You could type it in, but I don't recommend it. We don't want to do this every time we restart the server. So instead we go back to the certificate directory and store a decrypted version of the private key.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>cd \u002Fusr\u002Flocal\u002Fetc\u002Fssl\nmv ssl.key ssl.key.secure\nopenssl rsa -in ssl.key.secure -out ssl.key (Now you enter the passphrase)\n\u002Fetc\u002Finit.d\u002Fnginx restart\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>Try opening the site again! If everything went alright, you will now see a secure version of the index.html file.\u003C\u002Fp>\n\u003Cp>Objective three accomplished, we now have a protected connection.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Read on: \u003Ca href=\"\u002F2012\u002F10\u002Fa-secure-home-gateway-on-raspberry-pi_2406\u002F\">part four - proxying to your devices\u003C\u002Fa>\u003C\u002Fstrong>\u003C\u002Fp>\n",[16],{"author":17,"date":18,"html":19},"Anonymous","2015-10-27T05:46:36.893+01:00","\u003Ca href=\"https:\u002F\u002Fidwebhost.com\u002F\" rel=\"nofollow\">tempat nyari SSL murah ya di IDwebhost.com\u003C\u002Fa> Cuman disini kamu bisa menemukan paket terbaik untuk hosting webkamu.",{"title":21,"path":22},"A secure home gateway on the Raspberry Pi in four parts. Part four, proxying to your devices","\u002F2012\u002F10\u002Fa-secure-home-gateway-on-raspberry-pi_2406\u002F",{"title":24,"path":25},"A secure home gateway on the Raspberry Pi in four parts. Part two, setting up nginx on the Raspi","\u002F2012\u002F10\u002Fa-secure-home-gateway-on-raspberry-pi_14\u002F",[27,32,37,40,44,47,50,54],{"title":28,"path":29,"note":30,"series":31},"Mapping out Dark Code","\u002F2026\u002F03\u002Fmapping-out-dark-code\u002F","2026",false,{"title":33,"path":34,"note":35,"series":36},"The software that I love","\u002F2022\u002F10\u002Fthe-software-that-i-love\u002F","Series · 36 posts",true,{"title":38,"path":39,"note":30,"series":31},"Navigating the Fog of War: Age of Empires, AI Agents, and the Rise of Dark Code","\u002F2026\u002F05\u002Fnavigating-fog-of-war-age-of-empires-ai\u002F",{"title":41,"path":42,"note":43,"series":31},"The Future of Programming Systems - four thoughts","\u002F2024\u002F09\u002Fthe-future-of-programming-systems-four\u002F","2024",{"title":45,"path":46,"note":43,"series":31},"Always Optimize the Feedback Loop","\u002F2024\u002F07\u002Falways-optimize-feedback-loop\u002F",{"title":48,"path":49,"note":43,"series":31},"\"Security Is Our Top Priority\" is BS","\u002F2024\u002F07\u002Fsecurity-is-our-top-priority-is-bs\u002F",{"title":51,"path":52,"note":53,"series":31},"10x teams","\u002F2025\u002F02\u002F10x-teams\u002F","2025",{"title":55,"path":56,"note":53,"series":31},"Hiring, from the Other Side","\u002F2025\u002F10\u002Fhiring-from-other-side\u002F",1792876809146]