6 ms·

> being "loud" about that just ensures users will switch to a different browser. Do other browsers already have this feature? If not, I am not sure why someone

• tialaramex 5y ago
  Browsers have a variety of strategies to determine whether what they're shown is trustworthy. Two of the most common are: AIA Chasing. The browser examines the AIA section of the certificate it has been shown, and discovers a URL for another certificate, it fetches this URL, and parses the X.509 certificate it received, this may be enough to establish trust, but otherwise the browser might iterate, examining AIA again, fetching, and so on perhaps for some finite number of attempts before giving up. Intermediate caches. The browser remembers any CA certificates it saw recently, regardless of context, and it tries those when the chain presented is inadequate to see if they can "fill the gap" to a trusted root. For example maybe you visit Hacker News, it has a DigiCert intermediate, your browser remembers that, then you visit Jim's Trout Forum, Jim forgot to provide a full chain, but his is also a DigiCert certificate, the browser can see this is the missing piece. Both these strategies have problems, and this is why Mozilla moved from a cache strategy to carrying the entire set of intermediates. If you choose no strategy, you won't be able to reach maybe 10% of web sites securely because they don't offer you enough information to trust their certificate. Feel free to make it your life's mission to yell at all the site owners.