4 ms·

Google didn't force lets encrypt to totally get out of the client cert business, they just decided it wasn't worth the effort anymore.

• josephcsible 9mo ago
  > they just decided it wasn't worth the effort anymore That seems disingenuous. Doesn't being in the client cert business now require a lot of extra effort that it didn't before, due entirely to Google's new rule?
  • Avamander 9mo ago
    No, not really. Unless you consider basic accountability "extra effort".
    • account42 9mo ago
      Basic accountability doesn't pay for the infrastructure required for a separate root.
• everfrustrated 9mo ago
  Feel free to start your own non-profit to issue client certs signed by a public authority. As LE says, most users of client certs are doing mtls and so self-signed is fine.
  • account42 9mo ago
    "Most users" is a convenient excuse to ignore affected users.
• nickf 9mo ago
  Publicly-trusted client authentication does nothing. It's not a thing that should exist, or is needed.
  • ahmedtd 9mo ago
    I don't think this is true. It's something that could be useful, with some sort of ACME-like automated issuance, but should definitely be issued from a non-WebPKI certificate authority.
  • account42 9mo ago
    It does if the "client" in the TLS sense is really a public server in a federated network. Like for example in XMPP which you may have heard of.
    • direwolf20 9mo ago
      Then you specify your protocol to accept server certs from clients