3 ms·

> Operating a private CA ... does not allow me to host my own website that is visitable by a random person on the internet. It does if they install the CA cert

> Operating a private CA ... does not allow me to host my own website that is visitable by a random person on the internet. It does if they install the CA cert. UI is not pretty, but not insurmountable on standard browsers, OSs, or phones, and there is no interference unless you are working on a domain-joined Windows PC or your phone is under some sort of MDM. These UI issues with this process could be resolved by some browser UI work by parties that aren't interested in perpetuating the current status quo and can get past handholding boomers apparently willing to enter bank credentials into anything that moves. Or just use Gemini.

jakeogh 4y ago
Neat. Project Gemini: https://gemini.circumlunar.space/docs/specification.html https://gemini.circumlunar.space/docs/specification.html 4.2 Server certificate validation Clients can validate TLS connections however they like (including not at all) but the strongly RECOMMENDED approach is to implement a lightweight "TOFU" certificate-pinning system which treats self-signed certificates as first- class citizens. This greatly reduces TLS overhead on the network (only one cert needs to be sent, not a whole chain) and lowers the barrier to entry for setting up a Gemini site (no need to pay a CA or setup a Let's Encrypt cron job, just make a cert and go). I'm surprised to not see an optional response size field in the response header. How does the client calculate progress%? Reading....
GekkePrutser 4y ago
> UI is not pretty, but not insurmountable on standard browsers, OSs, or phones, and there is no interference unless you are working on a domain-joined Windows PC or your phone is under some sort of MDM. The problem is that while you can still add root CAs on modern Android, apps have to specifically opt-in to user-added root CAs. They can ignore them as they wish and I believe they have to even opt in to third-party CAs. Needless to say most apps don't bother. This is a big problem with self-signed certs on Android. I believe this was changed in version 7 or so. Not sure how this works on iOS but on Android it's really a problem.
- tenebrisalietum 4y ago
  I learned something here. Been a long time since I've had an Android phone (4.0.3 was the version of the last one I used IIRC).
superkuh 4y ago
I'm wondering how you think a random users on the internet is going to have already installed my self-signed CA root cert before going to my website? Gemini is fine. I love trust on first use for TLS. But there's no reason to drop HTTP/1.1.

jakeogh 4y ago

Neat. Project Gemini: https://gemini.circumlunar.space/docs/specification.html https://gemini.circumlunar.space/docs/specification.html 4.2 Server certificate validation Clients can validate TLS connections however they like (including not at all) but the strongly RECOMMENDED approach is to implement a lightweight "TOFU" certificate-pinning system which treats self-signed certificates as first- class citizens. This greatly reduces TLS overhead on the network (only one cert needs to be sent, not a whole chain) and lowers the barrier to entry for setting up a Gemini site (no need to pay a CA or setup a Let's Encrypt cron job, just make a cert and go). I'm surprised to not see an optional response size field in the response header. How does the client calculate progress%? Reading....

GekkePrutser 4y ago

> UI is not pretty, but not insurmountable on standard browsers, OSs, or phones, and there is no interference unless you are working on a domain-joined Windows PC or your phone is under some sort of MDM. The problem is that while you can still add root CAs on modern Android, apps have to specifically opt-in to user-added root CAs. They can ignore them as they wish and I believe they have to even opt in to third-party CAs. Needless to say most apps don't bother. This is a big problem with self-signed certs on Android. I believe this was changed in version 7 or so. Not sure how this works on iOS but on Android it's really a problem.

tenebrisalietum 4y ago
I learned something here. Been a long time since I've had an Android phone (4.0.3 was the version of the last one I used IIRC).

superkuh 4y ago

I'm wondering how you think a random users on the internet is going to have already installed my self-signed CA root cert before going to my website? Gemini is fine. I love trust on first use for TLS. But there's no reason to drop HTTP/1.1.