3 ms·
To protect your users Add your domain name to https://hstspreload.org https://hstspreload.org Get A+ from https://www.ssllabs.com/ssltest/ https://www.ssllabs
by darkhorn 6y ago
To protect your users
Add your domain name to https://hstspreload.org https://hstspreload.org
Get A+ from https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/
Use DNSSEC for your domain name https://dnssec-name-and-shame.com https://dnssec-name-and-shame.com
Enable Encrypted SNI in your web server https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/
- unilynx 6y agoNone of those steps will protect against a government requiring you to install a certificate
- crististm 6y agoI've talked with people at times that hierarchical CA is a bad idea and that peer-trust schemes are better for several reasons. They looked at me like I've just dropped from the Moon. I find these recent developments as evidence that I'm not.
- SahAssar 6y agoNone of that would help against this though, right? HPKP would if the site was visited before, but that is deprecated and removed from major browsers. Expect-CT might help but IIRC that is still a soft-fail.