5 ms·

Such as?

• Aldo_MX 11y ago
  Generating a trusted certificate?
  • nitrogen 11y ago
    Do you need to generate a cert for all HTTP/2 usage? Is there no opportunistic encryption?
    • gsnedders 11y ago
      There's no opportunistic encryption by design.
  • finnn 11y ago
    Lets Encrypt and is paving the way toward making that easier, and at this point it's already not all that hard.
    • Aldo_MX 11y ago
      Lets Encrypt's certs are not [yet] trusted since you are required to install a root certificate, for many end users this is not an option.
      • finnn 11y ago
        True, but they expect to have that done within a month. If you really want http 2.0 before that, then use one of the other free CAs
• dheera 11y ago
  Browsers shouldn't be the internet police. If either server or client wants to use encryption, encryption should be used. The browser should not have a say in this decision. Examples of cases where unencrypted HTTP makes sense: * Public, non-sensitive content that you need to distribute or broadcast using CDNs (such as Amazon's), who may charge you hundreds or thousands of dollars to install a custom server certificate if you want to use your own domain * Servers with limited CPU power and which are not serving sensitive content (e.g. embedded devices, Raspberry Pis, Arduinos et al.) * Getting a website up for $0.00 without paying some troll corporation to "validate" your certificate * Getting a website up to distribute information without revealing YOUR identity In any case, there are use cases, and it should not be the job of the browser to police this.
  • finnn 11y ago
    > * Public, non-sensitive content that you need to distribute or broadcast using CDNs (such as Amazon's), who may charge you hundreds or thousands of dollars to install a custom server certificate if you want to use your own domain If TLS is mandatory, the price of this will have to go down > * Servers with limited CPU power and which are not serving sensitive content (e.g. embedded devices, Raspberry Pis, Arduinos et al.) I've served TLS off embedded devices like these no problem >* Getting a website up for $0.00 without paying some troll corporation to "validate" your certificate Certificates are free (WoSign, StartCom, LetsEncrypt) >* Getting a website up to distribute information without revealing YOUR identity None of the free CAs validate anything beyond your email address (StartCom demands an address, but they don't seem to do much beyond validate that it's a valid address). DV certs are not to validate identity, just that you are the domain owner
    • ori_b 11y ago
      > I've served TLS off embedded devices like these no problem I doubt it -- Raspberry Pi is easy, but even HTTP on an Arduino would be a stretch.
    • daurnimator 11y ago
      > > * Servers with limited CPU power and which are not serving sensitive content (e.g. embedded devices, Raspberry Pis, Arduinos et al.) > I've served TLS off embedded devices like these no problem On e.g. a esp8266 you can only have a single TLS connection at a time. While you can have hundreds of normal TCP sessions. > Certificates are free (WoSign, StartCom, LetsEncrypt) - WoSign doesn't work on mildy old devices - StartCom certs are expensive to revoke - LetsEncrypt doesn't exist yet
      • nly 11y ago
        Why dont WoSign certs work on old devices? Their intermediate is cross-signed by Startcom
    • deftnerd 11y ago
      WoSign stopped doing free SSL in the last day or two, FYI.