If you want to test service workers on a client device that cannot run a web server on localhost, the general technique is as follows:
- Give your server a hostname.
- Give this hostname a certificate.
- Make IPs trust the CA that issued this certificate.
But this is easier said than done. In a November 2016 AMA on Reddit, a Let's Encrypt representative acknowledged that HTTPS on a private LAN "is a really tough question, and I think no one has come up with a satisfactory answer so far."
Common ways to give your computer a hostname involve giving it a stable internal IP address, not one that changes daily or every time you power-cycle your Internet gateway appliance. You'll need to configure the DHCP server on your network, usually that in your gateway, to set up a "reservation" that associates a particular private address (usualy within 10/8 or 192.168/16) with the MAC address of your development workstation's Ethernet card. For this, read the manual of your gateway.
Now that your development workstation has a stable IP address, there's a time/money tradeoff. If you're willing to learn advanced DNS and OpenSSL usage and install a root certificate on all devices with which you plan to test:
- Run an internal DNS server on your network. This could be on your gateway or on your development workstation.
- Configure your DNS server to be authoritative for some made-up TLD and recursive for other TLDs.
- Give a stable name to your development workstation's private IP address. This gives it an internal name.
- Configure your DHCP server to give the address of this DNS server to other devices obtaining leases.
- On your development workstation, use OpenSSL to generate keypairs for a private certificate authority and the web server.
- Using OpenSSL, issue a root certificate for the CA and a certificate for the web server's internal name.
- Configure HTTPS in the web server on your development workstation using this certificate.
- Install the CA's root certificate as a trusted root certificate on all devices.
- On all devices, access this internal name.
If you cannot add a root certificate or control local DNS, such as if you plan to test with devices owned by others (BYOD) or with more locked-down browsers that do not allow users to add trusted root certificates, such as those in major video game consoles, you'll need a fully-qualified domain name (FQDN):
- Buy a domain from a registrar that offers DNS with an API. This could be directly within a TLD or from one of the dynamic DNS providers that has made it onto the Public Suffix List. (Non-PSL dynamic DNS providers are unacceptable because of rate limits imposed by Let's Encrypt.)
- In this domain's zone file, point an
A record at your development workstation's private IP address. This gives your development workstation a FQDN.
- Use Dehydrated, an ACME client that supports the
dns-01 challenge, to obtain a certificate for this FQDN from the Let's Encrypt certificate authority.
- Configure HTTPS in the web server on your development workstation using this certificate.
- On all devices, access this name.