Skip to content

Update make-self-signed-cert.sh#3253

Open
flatsiedatsie wants to merge 2 commits intoWebThingsIO:masterfrom
flatsiedatsie:master
Open

Update make-self-signed-cert.sh#3253
flatsiedatsie wants to merge 2 commits intoWebThingsIO:masterfrom
flatsiedatsie:master

Conversation

@flatsiedatsie
Copy link
Copy Markdown
Contributor

make the self-signed certificate last 10 years instead of the default 1 month

make the self-signed certificate last 10 years instead of the default 1 month
Allow connecting to open wifi networks that do not require a password
@benfrancis
Copy link
Copy Markdown
Member

Is this currently causing a problem? I think this was originally added for automated testing. Are you using it for something else?

@flatsiedatsie
Copy link
Copy Markdown
Contributor Author

flatsiedatsie commented Apr 18, 2026

Interesting, I thought it was a feature. But the code suggests you're right 0_0.

In practise however, if you skipped the tunnel during the setup phase, then you can still access the gateway via https. As far as I'm aware this has always been possible? The https server will still start if the certificates exist, even if the tunnel has been otherwise skipped.

(Candle has always disabled the tunnel feature, so the user doesn't even get the option to skip it)

What's different now?

  • Candle 3.0 pushes users more actively to upgrade to https. For one, it's simply more secure. Secondly, they users can then use the QR code scanner that is built into the Matter adapter. There is an alternative scanner for http users too, but it involves communicating with a second browser window.
  • On a read-only disk it's not easy to update the certificate, causing the gateway to only have a valid certificate for a month.
  • A month is a very short period? I found multiple examples online that set the self-signed certificate to 3650 days by default.

This PR does not benefit Candle downstream, as it uses a much more modified version that will automatically increase encryption strengh in the coming years, and sets the domain to match the initial one.
https://github.com/createcandle/candle-controller/blob/master/tools/make-self-signed-cert.sh

I do hope you agree that using https on the local network is a useful feature to maintain. This PR aids that.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants