How do we import a self-signed certificate for the Polkadot-JS electron app or AppImage?

Question

According to https://wiki.polkadot.network/docs/maintain-wss#importing-the-certificate One can visit the cloud instance on https and download the certificate and then proceed to connect to a websocket via 443, but how can one achieve this using the electron App or Polkadot Appimage? I am currently on windows, and I can connect to my cloud via my browser, but not via my electron app, supposedly because my app cannot obtain the certificate.

Answer 1

You have a couple of options:

• If you are using a browser, you can do what it says in the docs - by clicking on "Proceed to site" in the browser pop-up the self-signed certificate should become whitelisted - which should then allow you to connect to a local node using the browser Polkadot interface.

• If you are using electron, you most likely won't get the "Proceed to site" popup since this is usually browser-specific - though a similar popup could be implemented in the Polkadot-JS electron app if you want to contribute to the repository: https://github.com/polkadot-js/apps

• You can expose the node endpoint on a public server port and create a certificate signed by a real certificate authority e.g. Let's encrypt (https://letsencrypt.org/docs/) - then you should be able to connect with Electron/Browser without any issues but this could be problematic if you want to keep the node private on localhost.

• Another option is to generate your own certificate, either self-signed or signed by a local root, and trust it in your operating system’s trust store. Then use that certificate in your local node's websocket endpoint.

The process of adding a self-signed certificate to a local trust store is different based on different operating systems:

On Arch/Fedora Linux (update-ca-trust):

1. Copy the self-signed certificate to:

/etc/ca-certificates/trust-source/anchors/mycertificate.crt

2. Update the trust store (as root):

sudo update-ca-trust

On Ubuntu/Debian Linux (security-trust-store):

1. Copy the self-signed certificate to:

/usr/local/share/ca-certificates/mycertificate.crt

2. Update the trust store (as root):

sudo update-ca-certificates

I'm less familiar with how to do this on Windows but I found an article online that might be of use:

make-a-self-signed-certificate-trusted-on-windows

And here's an article on how to do this on MacOS:

trust-self-signed-certificates-macos

1. Open Keychain Access and the All Items category (lower left)
2. Locate your self-signed certificate file (.pem, .p12, or something else) in Finder
3. Drag your certificate file from Finder to Keychain Access, in the list on the right
4. Open Certificates on the very bottom left
5. Find the certificate you just dragged in and double click it (if there’s a dropdown arrow on the left then just ignore that, we want the top level one)
6. Click the Trust dropdown arrow then change When using this certificate from System Defaults to Always Trust