The last time I reported a Letsencrypt CA misconfiguration to a major open source software ops team that was resulting in SSL errors in some of their clients, t

The last time I reported a Letsencrypt CA misconfiguration to a major open source software ops team that was resulting in SSL errors in some of their clients, they decided they knew better than I did how to operate TLS on the web and refused my report about sending the wrong intermediate, because they were expert users. As far as I know, they’re still inaccessible to this day in any browser that doesn’t do what Firefox does, that’s running on any slightly older unpatched OS, and they still think it’s everyone else’s fault that they’re receiving errors. SSL is too complex to successfully validate all possible errors locally over time without reports of semi-failures, and human superiority at dismissing semi-failures as non-issues remains unchallenged. So while I appreciate the spirit of the argument, I don’t think it works out that way in practice, and I can’t really find fault with the Firefox team for deciding (TIL) to ship a better intermediate navigator for doing so. The alternative is directing user complaints to often-uncaring operators.