2 ms·
The simple solution is a local certificate authority which is added to the users’ browsers. It can deliver certificates automatically or manually. This is one
by tinus_hn 5y ago
The simple solution is a local certificate authority which is added to the users’ browsers. It can deliver certificates automatically or manually.
This is one of the services provided by Microsoft Windows servers, or you can roll your own. It’s not hard and scales whatever way you want.
Expecting browser vendors to weaken security to avoid this tiny amount of work is backwards and will never happen.
- JoshTriplett 5y ago> The simple solution is a local certificate authority which is added to the users’ browsers. It can deliver certificates automatically or manually. I wish it was possible to add a certificate authority and restrict its usage to non-Internet servers (e.g. *.company.example). (This is theoretically possible if the CA bakes that in, though not all TLS stacks support that. It isn't possible via local browser configuration.)
- tinus_hn 5y agoIf you are the authority yourself, you can just commit to not giving out certificates outside a specific domain.
- JoshTriplett 5y agoIf you're the authority you can restrict the certificate authority to a given set of domains, but that's if you're the authority. I'd like browsers to give users control over that, to trust a CA in a limited fashion for only a subset of domains without trusting it to MITM the web.