title: HTTPS for local IP address
body: <p>I have a gadget[*] that connects to the user's WiFi network and responds to commands over a simple REST interface.  The user uses a web app to control this gadget.  The web app is currently served over <code>http</code> and the app's javascript does AJAX calls to the gadget's local IP address to control it.  This scheme works well and I have no issues with it.</p>
  
  <blockquote>
    <p>[*] By "gadget" I mean an actual, physical IoT device that the user buys and installs within their home, and configures to connect to their home WiFi network</p>
  </blockquote>
  
  <p>Now, I want to serve this web app over <code>https</code>. I have no issue setting up <code>https</code> on the hosting side.  The problem is, now the browser blocks access to the gadget (since the gadget's REST API is over <code>http</code> and not <code>https</code>).</p>
  
  <p>The obvious solution is to have the gadget serve it's REST API over <code>https</code>.  But how?  It has a local IP address and no one will issue a certificate for it.  (Even if they did, I'd have to buy a boatload of certificates for each possible local IP address.) I could round-trip via the cloud (by adding additional logic on my server side to accept commands from the web app and forward it to the gadget over another connection), but this will increase latencies.</p>
  
  <p>Is there a way around this problem? One possibility that I have in mind is to:</p>
  
  <ol>
  <li>Get a wildcard certificate (say, <code>*.mydomain.com</code>)</li>
  <li>Run my own DNS that maps sub-domains to a local IP address following a pattern (For example, <code>192-168-1-123.mydomain.com</code> would map to <code>192.168.1.123</code>)</li>
  <li>Use the wild-card certificate in all the gadgets</li>
  <li>My web app could then make AJAX calls to <code>https://192-168-1-123.mydomain.com</code> instead of <code>http://192.168.1.123</code> and latencies would remain unaffected aside from the initial DNS lookup</li>
  </ol>
  
  <p>Would this work?  It's an expensive experiment to try out (wildcard certificates cost ~$200) and running a DNS server seems like a <em>lot</em> of work.  Plus I find myself under-qualified to think through the security implications. </p>
  
  <p>Perhaps there's already a service out there that solves this problem?</p>