3 ms·
Excellent news. The more trust the better. It's still no good using LE for API endpoints as many client libs (java, etc) don't trust it or it's cross-signer.
by chillydawg 10y ago
Excellent news. The more trust the better. It's still no good using LE for API endpoints as many client libs (java, etc) don't trust it or it's cross-signer.
- ge0rg 10y agoIt is a good practice to use key / certificate pinning for your API endpoints anyway, and there you can provide any trusted KeyStore you want...
- pfg 10y agoThe most recent Java update added the DST (IdenTrust) root certificate. Of course it's going to take a while until that version is widely deployed, but this gives vendors the option to tell API consumers to just update Java (as opposed to manually modifying the key store), so that should help with adoption.
- teach 10y agoOh, that's excellent news!
- niij 10y agoJava 8u101 added trust for their cross signer, IdenTrust. https://bugs.openjdk.java.net/browse/JDK-8154757 https://bugs.openjdk.java.net/browse/JDK-8154757