3 ms·
This is exactly what Safari deciding to arbitrarily not trust valid certs is. The de facto standard will be that you will need to accommodate the least toleran
by User23 7y ago
This is exactly what Safari deciding to arbitrarily not trust valid certs is.
The de facto standard will be that you will need to accommodate the least tolerant user agent if you want your certs to work for all browsers.
- Wowfunhappy 7y agoBut Safari has laid out clear criteria as to under what conditions the certs will be invalid. If I'm understanding correctly, the GP is saying browsers should be making decisions based on a much wider variety of criteria (for example, who issued the cert, how popular is the website using the cert, etc), which would be much more difficult to troubleshoot.
- tialaramex 7y agoThe likely result is that two year certs will just cease to be available, even if other clients don't decide to make an equivalent rule. And yes, the de facto standard is that for the general purpose web you can't sell certificates based just on, for example, getting an OK from Microsoft (whose trust stores includes a tonne of governments and government agencies whose inclusion a cynic might assume is not coincidental to those governments agreeing to purchase Microsoft's products...) because those certificates don't work on an iPhone or in Firefox or... The relationship that is symbolised by the CA/Browser Forum has always been asymmetrical like this, it was this way before the CA/B Forum was created, and if the two groups aren't able to reach common ground the CA/B will just gradually go away.