3 ms·

After looking around for ~5 minutes I still can't find out if this HTTP/3 lib will allow establishment of an HTTP/3 connection with a self signed cert. Or if it

After looking around for ~5 minutes I still can't find out if this HTTP/3 lib will allow establishment of an HTTP/3 connection with a self signed cert. Or if it will allow non-encrypted connections. Does anyone know? Given the lack of any function names addressing TLS/CAs/encryption/etc I'm going to assume it's like all the other HTTP/3 implementations and fails to fully implement the spec. It's funny. Everyone defends MS/Google's HTTP/3 based on QUIC by saying the lack of ability to use plain text or self signed certs is the fault of the HTTP/3 implementations. But all the HTTP/3 lib implementations say it's the fault of QUIC.

deleted 3y ago
[deleted]
lights0123 3y ago
> Given the lack of any function names addressing TLS/CAs/encryption/etc Not only in its public API, but those are missing from its source code as well. I can't see where it could be doing any encryption—it doesn't even link to e.g. OpenSSL.
- jsnell 3y ago
  I don't think this is a free-standing implantation. The docs start with: > nghttp3 is a thin HTTP/3 layer over an underlying QUIC stack.
lights0123 3y ago
> I'm going to assume it's like all the other HTTP/3 implementations and fails to fully implement the spec... the lack of ability to use plain text or self signed certs Really? Does trusting a self-signed cert as a root cert not work in most libraries? quiche at least lets you control the parameters of their TLS implementation (https://docs.quic.tech/quiche/struct.Config.html#method.with_boring_ssl_ctx_builder https://docs.quic.tech/quiche/struct.Config.html#method.with...), which lets you go as far as allowing you to manually verify certs yourself (https://docs.rs/boring/latest/boring/ssl/struct.SslContextBuilder.html#method.set_verify_callback https://docs.rs/boring/latest/boring/ssl/struct.SslContextBu...).
johncolanduoni 3y ago
Where in the HTTP/3 spec does it allow for non-encrypted connections? HTTP/3 is a mapping of HTTP semantics to QUIC specifically, and QUIC mandates TLS 1.3 negotiation. Also quiche supports self-signed certificates (I use it with them). In fact I'm not aware of any raw QUIC or HTTP/3 implementations that don't allow implementing your own certificate handling.
- tedk-42 3y ago
  Considering you can't run nginx with http/2 unless you specify SSL, I'd say TLS/SSL is a requirement with this library.
ahoka 3y ago
Just create your own root CA and pin it in the clients.
- superkuh 3y ago
  How do I host a website visitable by random people I've never met on HTTP/3 without getting the continued/periodic approval of a third party corporation for a CA based TLS cert? I can't. That's bad. It's a very significant change from HTTP/1.1 (HTTP/2 is only used by corporations/institutions/non-human persons) in the past which allowed anyone to connect to anyone. It was truly a web. There's absolutely no way I can get my self-made root cert in the trust store of the major browsers so that a random person I've never met can connect. HTTP/3 is designed for the use cases of non-human persons. For human persons it's a terrible protocol.

deleted 3y ago

[deleted]

lights0123 3y ago

> Given the lack of any function names addressing TLS/CAs/encryption/etc Not only in its public API, but those are missing from its source code as well. I can't see where it could be doing any encryption—it doesn't even link to e.g. OpenSSL.

jsnell 3y ago
I don't think this is a free-standing implantation. The docs start with: > nghttp3 is a thin HTTP/3 layer over an underlying QUIC stack.

lights0123 3y ago

> I'm going to assume it's like all the other HTTP/3 implementations and fails to fully implement the spec... the lack of ability to use plain text or self signed certs Really? Does trusting a self-signed cert as a root cert not work in most libraries? quiche at least lets you control the parameters of their TLS implementation (https://docs.quic.tech/quiche/struct.Config.html#method.with_boring_ssl_ctx_builder https://docs.quic.tech/quiche/struct.Config.html#method.with...), which lets you go as far as allowing you to manually verify certs yourself (https://docs.rs/boring/latest/boring/ssl/struct.SslContextBuilder.html#method.set_verify_callback https://docs.rs/boring/latest/boring/ssl/struct.SslContextBu...).

johncolanduoni 3y ago

Where in the HTTP/3 spec does it allow for non-encrypted connections? HTTP/3 is a mapping of HTTP semantics to QUIC specifically, and QUIC mandates TLS 1.3 negotiation. Also quiche supports self-signed certificates (I use it with them). In fact I'm not aware of any raw QUIC or HTTP/3 implementations that don't allow implementing your own certificate handling.

tedk-42 3y ago
Considering you can't run nginx with http/2 unless you specify SSL, I'd say TLS/SSL is a requirement with this library.

ahoka 3y ago

Just create your own root CA and pin it in the clients.

superkuh 3y ago
How do I host a website visitable by random people I've never met on HTTP/3 without getting the continued/periodic approval of a third party corporation for a CA based TLS cert? I can't. That's bad. It's a very significant change from HTTP/1.1 (HTTP/2 is only used by corporations/institutions/non-human persons) in the past which allowed anyone to connect to anyone. It was truly a web. There's absolutely no way I can get my self-made root cert in the trust store of the major browsers so that a random person I've never met can connect. HTTP/3 is designed for the use cases of non-human persons. For human persons it's a terrible protocol.