I'm building a Raspberry Pi-based device for backyard gardeners that has a web page and access point for the initial configuration, including the Wi-Fi configuration. The connection uses WPA2 and the only two devices on that internal network would be the device itself and the user's phone/tablet/laptop. The access point is only visible during configuration which reduces the likelihood of outside attackers being able to guess the random, factory-shipped password. So I have encrypted traffic, almost certainly only two nodes, for a short time, and a random password. Thus there is no need for HTTPS that I can see, and I had planned to run HTTP.
However, today I learned that starting in July Chrome will begin marking all HTTP sites as insecure. But because the Wi-Fi configuration will be done by access point, no internet access is available yet to verify TLS certificates, which I understand is necessary for proper operation. I could self-sign the cert, but that presents other problems.
So my options seem to be:
- Present the configuration page with a big, scary, "This website is not secure" message
- Present the configuration page with a big, scary, "This certificate is not trusted" message (e.g. self-signed)
How would you provide that lovely green lock by default for a device configuration page?