Support SSL/TLS for ECS Server?

[synfinatic]

Would be very useful for users using aws-sso over ssh. Unclear if/how the certificate that we use would be trusted by the AWS SDK. Users would likely have to roll their own CA and inject it into the AWS SDK or figure out a way to use LetsEncrypt to generate a cert for localhost?

I suppose generating a trusted cert is really just left as an exercise for the reader. :-/

[synfinatic]

just point people to: https://letsencrypt.org/docs/certificates-for-localhost/

Should point out that their concern about MITM attacks isn't really relevant for aws-sso. Even if someone was to modify your DNS settings, the private key would be safe in the SecureStore so the connection would fail. I suppose the bigger issue is if LE would break things on their end?

[synfinatic]

So what if:

1. Users generate a self-signed cert (maybe aws-sso can do this for them?)
2. Private key is loaded into SecureStore, but cert is ~/.aws-sso/ecs-server.crt
3. ECS server uses both to do StartTLS()
4. ECS client reads the certificate and adds it to a copy of the trust store: https://forfuncsake.github.io/post/2017/08/trust-extra-ca-cert-in-go-app/
5. If a user wants to, they can copy the ecs-server.crt file to another host and then other clients would trust it too.