在一些第三方网站上，使用微信登录可以走免扫码快捷登录，本质是向 localhost.weixin.qq.com 发起请求：
而 localhost.weixin.qq.com 指向本地：
localhost.weixin.qq.com. 164 IN A 127.0.0.1
显然本地微信程序应该监听了 14013 端口，而且起了 https 服务，但是要完成 TLS 握手需要证书对应的私钥。难道说微信是把私钥随应用程序分发到每台电脑上？
Let's Encrypt 上有文章提及过这一点并指出不该这么做：
You might be tempted to work around these limitations by setting up a domain name in the global DNS that happens to resolve to 127.0.0.1 (for instance, localhost.example.com), getting a certificate for that domain name, shipping that certificate and corresponding private key with your native app, and telling your web app to communicate with https://localhost.example.com:8000/ instead of http://127.0.0.1:8000/. Don’t do this. It will put your users at risk, and your certificate may get revoked.
（...中略...）
This is considered a compromise of your private key, and your Certificate Authority (CA) is required to revoke your certificate if they become aware of it. Many native apps have had their certificates revoked for shipping their private key.
这里面已经说过历史上很多应用都这么做过，然后被吊销了证书，至少我借助 AI 问了下是这样的。 而且目前来看，微信也没有用 mkcert 这类用自签名的开发证书，所以好奇是怎么实现的？
求答疑解惑。
Select Language