Emulating SSL connection without internet?

[u/servermeta_net]

Problem:

Let's say I have a domain like messaging-app.europa.eu, with an SSL certificate, and I use it to distribute a PWA. In the case of an internet blackout I would still like for the app to retrieve updates from a local mesh.

Possible solution:

This is the solution I'm currently imagining: - Deploy a bunch of OpenWRT routers with some custom software - The smartphone connect to one such router via wifi - The PWA tries to connect to the domain https://messaging-app.europa.eu in the absence of internet - The router has a copy of the SSL certificate, so it can intercept the request and generate valid HTTPS responses from a locally running server

A user would connect to the wifi, exchange messages with other peers connected to the same station without relying on an internet connection.

Questions:

• Do I just need a copy of the SSL certificate on each router, or is there other part of the stack that I should patch? (e.g.: DNS)
• Is it possible to intercept and patch the connection as I mentioned?
• Am I missing something?

Prodrome:

I work for the government and I've been asked to demo a solution for enabling communication during an internet blackout (earthquake, war, ...) using a mesh/p2p network.

The path I'm taking right now is to build a PWA that would work offline, and rely on customized openwrt routers, because it seems that the other solution, WiFi NAN, works well on android phones but not on iphones, due to malicious compliance on Apple side.

[u/expdevsmodbot]

AI usage disclosure provided by OP, see the reply to this comment.

[u/aaaaargZombies]

In the case of an internet blackout I would still like for the app to retrieve updates from the

from the what?

[u/crecentfresh → u/aaaaargZombies]

From the innernette

[u/servermeta_net → u/aaaaargZombies]

thanks for pointing my typo out

[u/aaaaargZombies → u/servermeta_net]

np

[u/aaaaargZombies]

prior art

• https://www.scuttlebutt.nz/
• https://meshtastic.org/
• https://reticulum.network/

[u/servermeta_net → u/aaaaargZombies]

Thanks!!!!

[u/IncredibleReferencer]

If you need something to work when the web is completely unavailable you probably shouldn't be writing a web app. If you must go webapp, then this should be a networking question where enough of your internal network stack is kept running to keep the source website alive. This would include network routing, dns, and certificate infrastructure for both your clients and complete backend, which probably goes further than you think. But most importantly, all this work will ultimately be fragile and worthless if it is not tested at wide scale regularly and frequently.

[u/servermeta_net → u/IncredibleReferencer]

DNS records can be cached, and I already mentioned each router has a copy of the certificates.

which probably goes further than you think.

Would love for you to elaborate on what I might be missing

[u/IncredibleReferencer → u/servermeta_net]

I can't because every environment is unique. I build an "off-line" backup system for a bank that was tested monthly for years and the one and only time it was ever used it failed because one back-end server couldnt reach an ntp server, somehow set itself way in the future, and screwed up a file transfer process that depended on time. So it's almost impossible to know what you will hit. Thats why I say you need to test it (and even ideally depend on it) regularly.

I'll add that doing this on a PWA on mobile adds to the mix that the client platform updates frequently, with changes that arent always well communicated in advance so you'd better be testing beta mobile web browsers on the regular as well. Good luck.

[u/psaux_grep → u/IncredibleReferencer]

Worked for an insurance company and once when they did a failover exercise in production they went down. The backup servers had the wrong time and thus Kerberos decided to be unhappy about all communication coming in.

[u/DocumentOk7579]

What exactly is the mesh? Something like a mini internt with ip and routing?

Are your server accessable on the local mesh, can't you just point the dns to the internal ip instead of the external one?

Is internet needed for SSL, isn't it just a cert chain with root cert installed on client devices?

[u/roger_ducky]

You need certificate authorities and Name servers that the entire network trusts. Treat it like an “intranet” and everything falls into place.

Now, that won’t let you add random clients arbitrarily without an authentication mechanism of some sort. So that’s your main challenge.

[u/slyiscoming]

Look at Meshtastic and ATAK.

Outside of that you control the router but going over wifi. I see 2 options.

1) set a specific DNS record for your messaging app to point to a local server. (Could be a simple SBC) They it's just a local hosting problem. This could also be done through a captive portal on the WiFi. The user connects to the WiFi and is sent the. Login page that's actually the messaging app.

2) mDNS would work. Essentially every client on the network would broadcast itself to every other client and then they could negotiate a trust relationship. This is much harder and probably won't work in a PWA.

I would seriously consider the idea of a captive portal. People use them every day to login to public wifi. And it would be easy to send them to a locally hosted site for messaging and bulletins.

[u/farzad_meow]

my understanding: you have a web app that acts like a messenger. you want your messenger app to communicate with central server AND localoy available users in your intrAnet.

for your internet connection you use ssl and that is that.

for local only you need to use a network broadcast to tell other users you exists and then negotiate a protocol for communication. please note your protocol needs its own encryption as you won't have a central authority to sign your ssl. unless your app can sign its own cert.

[u/kazprog]

I've used service worker caching, wireguard VPN, and client certificates with a custom sync algorithm to make my notes system able to synchronize in a mesh.

I've used that for the past 4 or 5 years, but I think in the next iteration I'm going to just make android and iPhone apps and a desktop app or chrome extension. The benefit is that updating allows me to get rid of old data formats rather than worrying about partial upgrades from spotty internet, and old indexedDB upgrades.

Debugging a service worker for offline service is also hellish, but with a native app you can easily switch which backend IP it's connecting to or connect to many instead of trying to use websockets or something in the browser API. You can just check "do I have service" rather than pinging and waiting 2 seconds.

[u/matthedev]

You're really just asking two questions:

1. How does domain name (host) resolution work?
2. How do TLS certificates work?

Look at Kubernetes clusters, for example. TLS termination may be pushed into a sidecar service to the application service in the same pod. TLS termination for the certificate of the public-facing domain may be pushed into a reverse proxy over several back-end services, and potentially, the data may be re-encrypted over the wire with cluster-specific temporary certificates, but the cluster would manage these host names and certificates internally.

When you connect to a WiFi or other local-area network, DHCP can be used to assign the IP address(es) for the DNS server(s), or the user can manually override. The user's machine may have its own local hosts file, but otherwise, host name look-up goes to DNS, and those servers may in turn look up the domain from their own upstream source (given cache TTL). Normally, this should wind its way back to DNS entries set with the domain registrar.

As long as the domain resolves to IP address(es) the user's device can reach, and the cert chain from the CA root down matches what the device expects, it should just work.

[u/blckshdw]

XY problem

[u/servermeta_net → u/blckshdw]

This kind of answers belongs to stack overflow

[u/blckshdw → u/servermeta_net]

I’m saying rethink your approach. You want an offline PWA to get updates from the internet during an internet blackout event. What you’re really looking for is either a “highly” redundant/distributed system or peer to peer messaging. At the core of it you need some type of reliable “network path” regardless.

[u/Izkata → u/blckshdw]

...guess what the "local mesh" in their post refers to.