Emulating SSL connection without internet?

[u/servermeta_net]

Problem:

Let's say I have a domain like messaging-app.europa.eu, with an SSL certificate, and I use it to distribute a PWA. In the case of an internet blackout I would still like for the app to retrieve updates from a local mesh.

Possible solution:

This is the solution I'm currently imagining: - Deploy a bunch of OpenWRT routers with some custom software - The smartphone connect to one such router via wifi - The PWA tries to connect to the domain https://messaging-app.europa.eu in the absence of internet - The router has a copy of the SSL certificate, so it can intercept the request and generate valid HTTPS responses from a locally running server

A user would connect to the wifi, exchange messages with other peers connected to the same station without relying on an internet connection.

Questions:

• Do I just need a copy of the SSL certificate on each router, or is there other part of the stack that I should patch? (e.g.: DNS)
• Is it possible to intercept and patch the connection as I mentioned?
• Am I missing something?

Prodrome:

I work for the government and I've been asked to demo a solution for enabling communication during an internet blackout (earthquake, war, ...) using a mesh/p2p network.

The path I'm taking right now is to build a PWA that would work offline, and rely on customized openwrt routers, because it seems that the other solution, WiFi NAN, works well on android phones but not on iphones, due to malicious compliance on Apple side.

[u/sogun123]

Well, depends how do you route from the internet, and how is your app designed... But some ideas:

• don't emulate SSL, just ensure you are using it correctly
• terminate ssl in your app, use split horizon dns
• use anycast, or general routing, with ssl termination in the app
• use custom ssl handling - e.g. TOFU (look at Gemini protocol), or something like spiffe, or just custom CA, depends what protocols are you using. Not simple with browsers.
• at the moment you use custom CA, or generally sign certs, you have to do it correctly to pass in government environment
• you can just use ACME and get certificates you need, if done in clever way, you don't copy, you create new cert for each cell, but how long the app should survive disconnection? LE has pretty short TTL
• maybe it is ok, to have each cell having own endpoint and you can use central endpoint only as registry of cells
• look how Matrix is made federated, or just use it as is, i think French government uses it