3 ms·
Not the author, but I think the proposal would be for browsers to not display scary warning pages HTTPS requests using self-signed certificates where the hostna
by scarhill 9y ago
Not the author, but I think the proposal would be for browsers to not display scary warning pages HTTPS requests using self-signed certificates where the hostname is an RFC1918 IP address.
The argument is that self-signed certificates on internal-only IPs aren't any less secure than plain HTTP.
- DKnoll 9y ago>Not the author, but I think the proposal would be for browsers to not display scary warning pages HTTPS requests using self-signed certificates where the hostname is an RFC1918 IP address. In this case he makes no reference to hostnames, but short hostnames (not fully qualified) are a similar case. I believe they should still display a warning, but perhaps adjust the wording. SSL certs are not just useful for validation (domain validation, exstended validation) but also for fingerprinting. Self-signed certs are not a security risk provided you confirm it has the expected fingerprint and/or install it so it appears in browser as validated.
- captn3m0 9y agoChrome already has a flag to allow self signed cert when accessing localhost.