Auto-install local CA cert into Lynx

[skyfaller]

What would you like to be added

Does Smallstep auto-install its certs into the Lynx text-based web browser, as it does for Firefox? If not, can we add that feature? It appears that Lynx has support for self-signed certificates.

Why this is needed

I'm using the local CA in the Caddy web server on a remote machine, and I would like to be able to view my test websites on that machine by ssh-ing into the server and running Lynx from the terminal. If Lynx "just worked" without any further configuration on my part, it would make my day.

[skyfaller]

A brief discussion on the Caddy forum: https://caddy.community/t/v2-install-caddy-local-ca-cert-into-lynx/7521

[maraino]

Hi @skyfaller, I've tested lynx (2.8.8rel.2 and 2.8.9rel.1) and it properly accepts certificates installed in the system.

First, I've created a new PKI and a smallstep/certificates configuration with the DNS names 127.0.0.1, localhost, and the hostname of my machine:

$ step ca init

Then I installed my root certificate running:

$ step certificates install ~/.step/certs/root_ca.crt
step certificate install ~/.step/certs/root_ca.crt
Certificate /root/.step/certs/root_ca.crt has been installed.
X.509v3 Root CA Certificate (ECDSA P-256) [Serial: 2093...3633]
  Subject:     Smallstep Root CA
  Issuer:      Smallstep Root CA
  Valid from:  2020-04-30T23:37:49Z
          to:  2030-04-28T23:37:49Z

Then I started step-ca with the configuration created on the first step:

$ step-ca ~/.step/config/ca.json

This CA runs an HTTPS server using a certificate automatically generated using the intermediate certificate created on the first step.

Then just tested lynx against that CA, and got the expected response without an error:

$ lynx -source https://localhost:9000/health
{"status":"ok"}

Somehow lynx fails with 127.0.0.1, but it does not look like an SSL error:

$ lynx -source https://127.0.0.1:9000/health

Looking up 127.0.0.1:9000
Making HTTPS connection to 127.0.0.1:9000
SSL callback:ok, preverify_ok=1, ssl_okay=0
SSL callback:ok, preverify_ok=1, ssl_okay=0
SSL callback:ok, preverify_ok=1, ssl_okay=0

lynx: Can't access startfile https://127.0.0.1:9000/health

Then I uninstalled the root certificate to see the behavior without it:

$ step certificate uninstall ~/.step/certs/root_ca.crt
Certificate /root/.step/certs/root_ca.crt has been removed.
X.509v3 Root CA Certificate (ECDSA P-256) [Serial: 2093...3633]
  Subject:     Smallstep Root CA
  Issuer:      Smallstep Root CA
  Valid from:  2020-04-30T23:37:49Z
          to:  2030-04-28T23:37:49Z
$ lynx -source https://localhost:9000/health

Looking up localhost:9000
Making HTTPS connection to localhost:9000
SSL callback:unable to get local issuer certificate, preverify_ok=0, ssl_okay=0
Retrying connection without TLS.
Looking up localhost:9000
Making HTTPS connection to localhost:9000
SSL callback:unable to get local issuer certificate, preverify_ok=0, ssl_okay=0
Alert!: Unable to make secure connection to remote host.

lynx: Can't access startfile https://localhost:9000/health
$ lynx -source https://127.0.0.1:9000/health

Looking up 127.0.0.1:9000
Making HTTPS connection to 127.0.0.1:9000
SSL callback:unable to get local issuer certificate, preverify_ok=0, ssl_okay=0
Retrying connection without TLS.
Looking up 127.0.0.1:9000
Making HTTPS connection to 127.0.0.1:9000
SSL callback:unable to get local issuer certificate, preverify_ok=0, ssl_okay=0
Alert!: Unable to make secure connection to remote host.

lynx: Can't access startfile https://127.0.0.1:9000/health

So it looks like lynx works.

[maraino]

One thing more, depending on the distribution step uses different commands to install the certificate, depending on the availability it will use:

• update-ca-trust
• update-ca-certificates (the one it used in my system)
• trust

The logic to pick one of those is here https://github.com/smallstep/truststore/blob/903b41c208c1fab27284c1d75790a2cbf4df731e/truststore_linux.go#L31-L40