HTTP 加密，无需身份验证
我想分发一个小型应用程序，该应用程序提供供本地使用的 Web 界面。因此，它只会绑定到环回，但有人可能希望在虚拟或真实网络接口上使用它。
至少到那时，产生的流量就会受到窃听。
我想我不能让用户承担生成和安装 HTTPS 证书/密钥的工作，所以我的问题：是否有一种方法可以在服务器端没有此类证书/密钥的情况下与标准浏览器建立加密连接，放弃来自服务器身份验证？
I want to distribute a small application that offers a web interface intended for local use. It will therefore bind to loopback only, but there is a chance that someone will want to use it on a virtual or real network interface.
At least then, the arising traffic becomes subject to eavesdropping.
I guess I can't burden the user with the job of generating and installing a HTTPS certificate/key, so my question: Is there a way of establishing an encrypted connection with a standard browser without such certificate/key on the server side, abstaining from server authentication?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果没有 SSL 和证书，您将必须构建自己的身份验证和加密协议，这并非易事。可以在您的 Web 服务器上使用自签名 SSL 证书，以便您可以使用您想要的任何域名，问题是它要求每个客户端信任该证书（通过将其导入到计算机中）。在企业环境中，还有 IPSec 保护所有流量。
Without SSL and a certificate, you will have to build your own authentication and encryption protocol, which isn't trivial. It's possible to use a self-signed SSL certificate on your web server so that you can use any domain name you want, problem is it requires each client to trust that certificate (by importing it to the machine). In enterprise environment there is also IPSec which protects all traffic.
您可以购买主机名或 IP 地址的 SSL 证书并在本地使用。
You can buy a SSL certificate for a hostname or an IP address and use it locally.