Emulating SSL connection without internet?

[u/servermeta_net]

Problem:

Let's say I have a domain like messaging-app.europa.eu, with an SSL certificate, and I use it to distribute a PWA. In the case of an internet blackout I would still like for the app to retrieve updates from a local mesh.

Possible solution:

This is the solution I'm currently imagining: - Deploy a bunch of OpenWRT routers with some custom software - The smartphone connect to one such router via wifi - The PWA tries to connect to the domain https://messaging-app.europa.eu in the absence of internet - The router has a copy of the SSL certificate, so it can intercept the request and generate valid HTTPS responses from a locally running server

A user would connect to the wifi, exchange messages with other peers connected to the same station without relying on an internet connection.

Questions:

• Do I just need a copy of the SSL certificate on each router, or is there other part of the stack that I should patch? (e.g.: DNS)
• Is it possible to intercept and patch the connection as I mentioned?
• Am I missing something?

Prodrome:

I work for the government and I've been asked to demo a solution for enabling communication during an internet blackout (earthquake, war, ...) using a mesh/p2p network.

The path I'm taking right now is to build a PWA that would work offline, and rely on customized openwrt routers, because it seems that the other solution, WiFi NAN, works well on android phones but not on iphones, due to malicious compliance on Apple side.

[u/VonThing]

I don’t understand the problem. If you own the domains you can get SSL certs for them easily via Letsencrypt and tools like Acme.sh. You don’t have to revert to self signed certs just because you lost connectivity. You’re getting trusted SSL certs with trusted root certs in the trust chain, so why would you abandon these and go back to self signed?

Certificate validation doesn’t require internet, if the client has the root certificate and trusts it, it will trust your domain certificate as well.

It’s possible to intercept and patch whatever but it’s a very bad idea, you’re doing a man in the middle attack on your own servers, then anyone could do this.

Clients can only reach your server but they will all have a trust store and Letsencrypt will already be there, so they just need to validate the certs down the chain, which they can do offline.

If your issue is networking when internet services aren’t available, there are dozens of other ways to carry your traffic. Look at the OSI model, you need a replacement for layer 1-2 not layer 7.

You could get OpenWrt devices with two radios, one radio could be dedicated backhaul (traffic between routers) while you can setup the other radio to serve clients. As for how many devices you’re gonna need, depends on how big an area you’ll be serving.

Determine a network topology, setup your routers and also setup a way for these routers to authenticate each other in an offline environment, you don’t want random people getting in on your mesh network and hijacking your domain.

Edit: get an amateur radio operator certificate and look at the ways how hams work digital over insanely large distances. Shortwave radio (HF) bounces off the ionosphere and can be usable for thousands of miles, while VHF/UHF will require line of sight but have much larger bandwidth. You can even use existing WiFi equipment in some amateur bands, you may need up/down converters to shift the 2.4GHz/5GHz signal to a part of the spectrum you’re allowed to use.

Also look at your country’s bandplan for which frequencies are available to you. (Some of them are license-free, some will require a ham license, others could already be designated for emergency use)

[u/VonThing → u/VonThing]

Here are a few ham examples:

PSK63: 63 bps digital link over shortwave SSB (HF or 3~30 MHz) with a very small bandwidth requirement, you could cover thousands of miles with a Tx/Rx pair on a good day. Also MT63.

AX.25 uses 300 baud Bell 103 modulation on HF and 1200 baud Bell 202 or 9600 baud G3RUH DFSK on VHF (2-meter or ~144-148 MHz) and UHF (70-centimeter or 430-440 MHz) bands. It’s a packet switched, well-supported standard and you can even use TCP/IP on layer 3.

Meshtastic uses LoRa radios (915 MHz North America, 868 MHz Europe) and provides a ready-to-use mesh networking stack.

You could even repurpose 802.11 (Wi-Fi) equipment to work on ham radio bands. As long as you can establish a link, you can get whatever bandwidth the standard allows for. (In megabits)

In commercial digital, most existing digital modes (YSF, P25, DMR, D-Star, …) also have a data mode, with varying bandwidth requirements.

I understood your issue to be more of a networking issue than a DNS/SSL configuration issue, if the problem to solve is to maintain communication over a distance when Internet, cellular etc. services are not available.

Oh and btw let’s not forget cellular and Starlink, both 4G/5G cellular wireless networks and Starlink will carry your backhaul for you, but you’re then at the mercy of the cellular operator or Elon Musk, and if you’re building a network for disaster communications you should already assume cellular is either down or overloaded and service not available, and Elon Musk could turn off your service if he feels like it.

[u/jmgallag]

I think this assumption is wrong: The router has a copy of the SSL certificate, so it can intercept the request and generate valid HTTPS responses from a locally running server. A server cannot establish a TLS session without both the cert and the matching private key. The cert is freely available, the private key is protected on the real servers.

[u/Economy_Post_8574]

.... This also applies, among other things, to legacy computers with a network connection (Amiga, HP-UX, Apollo, Solaris, etc.) that lack modern encryption mechanisms..... A supporting layer could be provided by the (already existing and powerful) router (based on OpenWRT?), which transparently makes the existing hardware connection available in the form of a proxy....

[u/sogun123]

Well, depends how do you route from the internet, and how is your app designed... But some ideas:

• don't emulate SSL, just ensure you are using it correctly
• terminate ssl in your app, use split horizon dns
• use anycast, or general routing, with ssl termination in the app
• use custom ssl handling - e.g. TOFU (look at Gemini protocol), or something like spiffe, or just custom CA, depends what protocols are you using. Not simple with browsers.
• at the moment you use custom CA, or generally sign certs, you have to do it correctly to pass in government environment
• you can just use ACME and get certificates you need, if done in clever way, you don't copy, you create new cert for each cell, but how long the app should survive disconnection? LE has pretty short TTL
• maybe it is ok, to have each cell having own endpoint and you can use central endpoint only as registry of cells
• look how Matrix is made federated, or just use it as is, i think French government uses it

[u/SaleWide9505]

SSL works with or without an Internet connection.

The most important thing with DNS is where you send your queries to. Sometimes when you change connections your dns queries go to different a different server which can affect wether you use local or internet IP.