B brandongalbraith

How to set up stress-free SSL on an OS X development machine

One of the best ways to reduce complexity (read: stress) in web development is to minimize the differences between your development and production environments. After being frustrated by attempts to unify the approach to SSL on my local machine and in production, I searched for a workflow that would make the protocol invisible to me between all environments.

Most workflows make the following compromises:

Use HTTPS in production but HTTP locally. This is annoying because it makes the environments inconsistent, and the protocol choices leak up into the stack. For example, your web application needs to understand the underlying protocol when using the secure flag for cookies. If you don't get this right, your HTTP development server won't be able to read the cookies it writes, or worse, your HTTPS production server could pass sensitive cookies over an insecure connection.
Use production SSL certificates locally. This is annoying

Update: 2023/11/30 Bruce Momjian's take on things: https://momjian.us/main/blogs/pgblog/2023.html#November_22_2023

Given a table...

CREATE TABLE foo (
  id SERIAL PRIMARY KEY,
  created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
  ...
);

Each of these commands will run an ad hoc http static server in your current (or specified) directory, available at http://localhost:8000. Use this power wisely.

Discussion on reddit.

Python 2.x

$ python -m SimpleHTTPServer 8000

GENERAL TODO:

The examples are all over the place. They need to be more consistent.
Check that x-archive-queue-derive header. I just skimmed it and it doesn't seem right.
Investigate getting an "[email protected]" address for support requests
Some of the standard metadata fields are repeatable, some are not. State this in the descriptions.
Excellent Hank idea: Quick Start (TL;DR) section to avoid all the gory details
Dang, but this damn thing is hard to read. Will that get better when it gets converted to the PHP wrapper? I have my doubts. May need a some quick George love to give tips for better readability.
All the other 'foo' (read: green) bits below

	# Basically the nginx configuration I use at konklone.com.
	# I check it using https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com
	#
	# To provide feedback, please tweet at @konklone or email [email protected].
	# Comments on gists don't notify the author.
	#
	# Thanks to WubTheCaptain (https://wubthecaptain.eu) for his help and ciphersuites.
	# Thanks to Ilya Grigorik (https://www.igvita.com) for constant inspiration.

	server {

	After spending the better part of the month implementing date support
	in RethinkDB, Mike Lucy sent the team the following e-mail. It would
	have been funny, if it didn't cause thousands of programmers so much
	pain. Read it, laugh, and weep!

	-----

	So, it turns out that we're only going to support dates between the
	year 1400 and the year 10000 (inclusive), because that's what boost
	supports.

	require 'rubygems'
	require 'mechanize'

	FIRST_NAME = 'FIRST_NAME'
	LAST_NAME = 'LAST_NAME'
	PHONE = 'PHONE'
	EMAIL = '[email protected]'

	PARTY_SIZE = 2
	SCHEDULE_RANGE = { :start_time => '19:00', :end_time => '20:30' }

	import sys

	from PIL import Image, ImageDraw

	try:
	import cv
	except ImportError:
	print 'Could not import cv, trying opencv'
	import opencv.cv as cv

	"Instructions"

	1) Install index.php to some webserver, and run "latlongudp.pl" on the same server.

	2) Then feed IPs to the latlongudp.pl server with something like this:

	tail -F /var/log/nginx/access_log\|perl -e '$\|=1;while(<>){print "someidentifier,$1\n" if/(\d+\.\d+\.\d+\.\d+)/}'\|nc -u somenode.example.com 5001

	Modify someidentifier to to fit your needs.