intercert icon indicating copy to clipboard operation
intercert copied to clipboard

Require encrypted gRPC communication

Open evenh opened this issue 5 years ago • 0 comments

Currently insecure communication (no TLS) is used between the client and the server. This is bad a security related application :trollface:

A suggested fix would be to:

  1. Extend server configuration to include properties for supplying a certificate + private key. The client configuration should include configuration for specifying a public key.
  2. Bundle a hardcoded/generated TLS cert for using without explicit configuring custom TLS certs. When used in this mode, a very prominent warning should be logged both on the server and in the client, to encourage users to supply their own certs.

evenh avatar Jan 20 '19 19:01 evenh