在硬件设备上保护websockets

Question

I have a hardware device that is communicating over websockets with the Browser. The problem is that I want a secure connection, unfortunately browsers don't connect to self signed certificate. the problem is that every hardware device can have another IP, and certificates are limited on domains. I cannot buy a certificate for each Hardware.. So what can I do?

Answer 1

The problem is that I want a secure connection, unfortunately browsers don't connect to self signed certificate.

Certificates are used to securely identify the peer. Proper identification is necessary to make sure no man-in-the-middle attacks are possible. Thus it makes no sense to share the same certificate within 100's of different machines and you would have problems to keep the same private key secure anyway.

The alternative are self-signed certificates. But browsers don't connect without warning in this case, because if they would man-in-the-middle attacks would be trivial. This means that the user must explicitly acknowledge this certificate as trusted and you have to educate the user how this must be done with the various browsers.

If browsers and devices are all under one control (like within a company-wide roll out) you might instead use your own PKI structure where all certificates are issued by your own CA and this CA is trusted by all your browsers.

the problem is that every hardware device can have another IP, and certificates are limited on domains.

No, certificates can be generated to identify IP addresses too. You will usually not get these certificates by a public CA, but a private CA can issue such certificates and self-signed certificates work too. Of course, using IP address instead of a name makes only sense if the IP will be constant for a very long time.