4 ms·
Given that this is just due to a Chrome Root Store policy, it seems like a possible solution is to maintain two PKI root stores, one for browsers and one for se
by kbolino 1y ago
Given that this is just due to a Chrome Root Store policy, it seems like a possible solution is to maintain two PKI root stores, one for browsers and one for servers. The server one can be a superset of the browser one, adding CAs that allow client auth. This way, you could request a client certificate from Let's Encrypt that works everywhere except a browser.
- bigbuppo 1y agoSpecifically this... the members of the CA/Browser Forum cartel have no idea how certificates are actually used in the real world, and even admit that when they all agreed to lower the maximum duration for certificates to 47 days.