4 ms·
I hate this idea. What happens if the server starts at a point in time when it cannot do the AIA chasing? That means that you have a (silent) dependency that y
by ayende 5y ago
I hate this idea. What happens if the server starts at a point in time when it cannot do the AIA chasing?
That means that you have a (silent) dependency that you are absolutely unaware of. When this fails, your service is down.
Far better to have it setup so the service fails if the certificate is not configured with the whole chain.
- tialaramex 5y agoWhat I propose (AIA chasing in servers) can be dropped into existing servers and it won't make anything worse, in most cases it will make things better. What you propose either can't be dropped in (so it's an interesting experiment for a new web server, are you writing one? No? Then it's of no value) or if it's dropped in it breaks working systems, making you a nuisance. If you have a time machine so you can go back to the mid-1990s and ensure all web servers work your way your idea is better or at least good. But you don't have a time machine, we must work with what exists today.
- patmorgan23 5y agoIf the AIA fails it could just continue as normal.