2 ms·
I think they meant, can't a visitor just ignore that your cert is self-signed and view the page anyway, _without_ adding it to the trust store. Firefox, at leas
by remexre 3y ago
I think they meant, can't a visitor just ignore that your cert is self-signed and view the page anyway, _without_ adding it to the trust store. Firefox, at least, has this as the default "ignore the cert error" action.
- superkuh 3y agoSetting up a root cert in a trust store and accepting a non-root self-sign cert are very different things. That said, "can't a visitor just ignore that your cert is self-signed and view the page anyway," No. They cannot. Not when it's HTTP/3. Even if the browser ostensibly supports it the HTTP/3 connection will fail because the HTTP/3 lib Firefox uses does not allow it.
- paradite 3y agoWould that actually help your cause, since it would push people to build and distribute their own user agents which accepts self-signed certs/CA in a user-driven community without big corp oversight?
- PH95VuimJjqBqy 3y agoYou'd have to get all the major browsers to trust that CA, it's not possible to do that without "corporate oversight". That's the point the other poster is making, it adds a new level of control that becomes the de facto only way to do things if http 1.1 ever gets deprecated. I have no opinion on the likelihood of any such deprecation but I fully understand the concern.