4 ms·

Can't you sign your own certificates? Whether people trust those is a different story. WAI is different because it breaks abstraction by asserting based on deta

Can't you sign your own certificates? Whether people trust those is a different story. WAI is different because it breaks abstraction by asserting based on details which are otherwise invisible to the server.

jiggawatts 3y ago
> Can't you sign your own certificates? Self-signed certificates are banned in HTTP/2 onwards, which is really irritating when it is used for internal server-to-server communications. You have to set up a Root CA certificate and use that to sign a second certificate. It's the same thing but with extra steps.
- charcircuit 3y ago
  I've never had an issue using HTTP/2 with a self signed cert.
- creatonez 3y ago
  Huh? Self-signed certificates work with HTTP/2 in every browser I've tried it in, it just uses the usual trust-on-first-use system where you have to click past a warning.
- sgammon 3y ago
  That's still self-signing. So the extra steps are immaterial to the point.
superkuh 3y ago
You can. It's just that no browser that supports HTTP/3 will accept it as a legit endpoint with a valid root. So they won't connect to the HTTP/3 endpoint at all and you won't be able to access the HTTP/3 self-signed website. And before anyone goes there, no, setting up your own root CA is not an option. Unless you get can Google/Apple/Mozilla/etc to include your root CA in their browser trust stores it doesn't help a random person visit your website at all.
- sgammon 3y ago
  That's still self-signing. So the extra steps are immaterial to the point.
- fruitreunion1 3y ago
  >You can. It's just that no browser that supports HTTP/3 will accept it as a legit endpoint with a valid root. So they won't connect to the HTTP/3 endpoint at all and you won't be able to access the HTTP/3 self-signed website. So long as there's a way to bypass verification or configure the trust store I'm okay with it. Is there official policy stating that this won't be possible or is this prediction? As I understand it the primary reason for this push is that non-technical users too often skip security warnings, but I'm of the position there MUST at least be a way to bypass verification no matter what (through keyboard combos or a configurable trust store).

jiggawatts 3y ago

> Can't you sign your own certificates? Self-signed certificates are banned in HTTP/2 onwards, which is really irritating when it is used for internal server-to-server communications. You have to set up a Root CA certificate and use that to sign a second certificate. It's the same thing but with extra steps.

charcircuit 3y ago
I've never had an issue using HTTP/2 with a self signed cert.
creatonez 3y ago
Huh? Self-signed certificates work with HTTP/2 in every browser I've tried it in, it just uses the usual trust-on-first-use system where you have to click past a warning.
sgammon 3y ago
That's still self-signing. So the extra steps are immaterial to the point.

superkuh 3y ago

You can. It's just that no browser that supports HTTP/3 will accept it as a legit endpoint with a valid root. So they won't connect to the HTTP/3 endpoint at all and you won't be able to access the HTTP/3 self-signed website. And before anyone goes there, no, setting up your own root CA is not an option. Unless you get can Google/Apple/Mozilla/etc to include your root CA in their browser trust stores it doesn't help a random person visit your website at all.

sgammon 3y ago
That's still self-signing. So the extra steps are immaterial to the point.
fruitreunion1 3y ago
>You can. It's just that no browser that supports HTTP/3 will accept it as a legit endpoint with a valid root. So they won't connect to the HTTP/3 endpoint at all and you won't be able to access the HTTP/3 self-signed website. So long as there's a way to bypass verification or configure the trust store I'm okay with it. Is there official policy stating that this won't be possible or is this prediction? As I understand it the primary reason for this push is that non-technical users too often skip security warnings, but I'm of the position there MUST at least be a way to bypass verification no matter what (through keyboard combos or a configurable trust store).