4 ms·
> Client certs alone are good for authentication (don't work in HTTP/2 though) Um, what? Did client certs get removed from HTTP 2?
by noinsight 9y ago
> Client certs alone are good for authentication (don't work in HTTP/2 though)
Um, what? Did client certs get removed from HTTP 2?
- detaro 9y agoYes. As far as I understand, the problem was that the requirement for a certificate is a per-request thing, but HTTP 2 can have multiple requests in flight over the same TLS connection at the same time and thus can't just renegotiate the connection when it comes up. There have been proposals to fix this, but nothing has gained the necessary interest and traction. Servers can ask the client to fall back to HTTP 1.1 instead, and then use client-certificates there.
- j_s 9y agoI have been collecting conflicting reports on HTTP/2 client certificate support: 14 months ago: "No. But TLS!" https://news.ycombinator.com/item?id=11556762 https://news.ycombinator.com/item?id=11556762 7 months ago: "421" https://news.ycombinator.com/item?id=13022596 https://news.ycombinator.com/item?id=13022596 Maybe it would be worth the time to test out the various implementations if someone has not already done so? -- Doing some preliminary research, support is still a working draft https://datatracker.ietf.org/doc/draft-bishop-httpbis-http2-additional-certs/?include_text=1 https://datatracker.ietf.org/doc/draft-bishop-httpbis-http2-... source: https://daniel.haxx.se/blog/2016/08/18/http2-connection-coalescing/ https://daniel.haxx.se/blog/2016/08/18/http2-connection-coal...