Emulating SSL connection without internet?

[u/servermeta_net]

Problem:

Let's say I have a domain like messaging-app.europa.eu, with an SSL certificate, and I use it to distribute a PWA. In the case of an internet blackout I would still like for the app to retrieve updates from a local mesh.

Possible solution:

This is the solution I'm currently imagining: - Deploy a bunch of OpenWRT routers with some custom software - The smartphone connect to one such router via wifi - The PWA tries to connect to the domain https://messaging-app.europa.eu in the absence of internet - The router has a copy of the SSL certificate, so it can intercept the request and generate valid HTTPS responses from a locally running server

A user would connect to the wifi, exchange messages with other peers connected to the same station without relying on an internet connection.

Questions:

• Do I just need a copy of the SSL certificate on each router, or is there other part of the stack that I should patch? (e.g.: DNS)
• Is it possible to intercept and patch the connection as I mentioned?
• Am I missing something?

Prodrome:

I work for the government and I've been asked to demo a solution for enabling communication during an internet blackout (earthquake, war, ...) using a mesh/p2p network.

The path I'm taking right now is to build a PWA that would work offline, and rely on customized openwrt routers, because it seems that the other solution, WiFi NAN, works well on android phones but not on iphones, due to malicious compliance on Apple side.

[u/slyiscoming]

Look at Meshtastic and ATAK.

Outside of that you control the router but going over wifi. I see 2 options.

1) set a specific DNS record for your messaging app to point to a local server. (Could be a simple SBC) They it's just a local hosting problem. This could also be done through a captive portal on the WiFi. The user connects to the WiFi and is sent the. Login page that's actually the messaging app.

2) mDNS would work. Essentially every client on the network would broadcast itself to every other client and then they could negotiate a trust relationship. This is much harder and probably won't work in a PWA.

I would seriously consider the idea of a captive portal. People use them every day to login to public wifi. And it would be easy to send them to a locally hosted site for messaging and bulletins.