Flood: Generating default SSL certificate and use by default

[jfurrow]

Expected Behavior

1. Flood should generate a self-signed SSL certificate and use it automatically by default.
2. Users should be able to disable this.

Current Behavior

Flood doesn't do this.

Possible Solution

Generate an SSL with something like pem.

Context

See https://github.com/jfurrow/flood/pull/544

[SanPilot]

After thinking about this some more, I don't think this is such a good idea. Self signed certificates don't provide any substantial security, and will likely cause off-putting errors in the browser. Instead, the procedure should be documented for the users who want the extra security.

[dcousens]

@SanPilot they provide transport layer security.
They implicitly have no authentication; so you could be dealing with an attacker.

It might prevent passive eavesdropping, but not any active MITM.

[wopian]

Implementing LetsEncrypt with it's Express middleware for a proper SSL certificate would be a better idea imo 👍

[noraj]

Generating a LetsEncrypt cert should not be default because it's useless to generate it if it won't be used. Let people choose this.

[randomnonsense]

Let people generate their own certs the way they see fit. Perhaps simply cover that by more detailed docs. Anybody can use letsencrypt, especially in certonly standalone mode. It's a single command thing. Again, you're trying to re-invent something already working very well.

Add better tutorial and let people handle little stuff themselves.

[0xcaff]

Anyone who wants to secure this application can do so with a reverse proxy outside of the application layer. Here's a guide. I think this should be left up to the user.

[noraj]

I also made 2 guide:

• ArchLinux - Install rTorrent and ruTorrent
• OpenSUSE : Install rTorrent and ruTorrent

The two guides handle the configuration of the reverse proxy with nginx and are using quite secure configs. I didn't make one for flood but that's nearly the same.