4 ms·

You are misunderstanding. The requirement for CA-issued certificates and most of the other things you are ranting about will still be only for HTTPS, which will

You are misunderstanding. The requirement for CA-issued certificates and most of the other things you are ranting about will still be only for HTTPS, which will still be optional. HTTP URIs in HTTP/2 will only need self-signed certificates which can be generated automatically by the server. Once servers get good support for it will not be any harder than HTTP/1.1.

dragonwriter 12y ago
> HTTP URIs in HTTP/2 will only need self-signed certificates which can be generated automatically by the server. Where in the spec is there anything that HTTP URIs in HTTP/2 require any kind of certificate? Anyhow, I think its moot because all of the major browser vendors that have committed to HTTP/2 support have also announced they will support it only for HTTPS URIs, so what HTTP URIs require really only matters for non-browser HTTP-based applications that plan to use HTTP/2.
- dark_photon 12y ago
  > they will support it only for HTTPS URIs No. They may do that now but the intention is to support HTTP URIs that force TLS but allow self-signed certificates. See https://wiki.mozilla.org/Networking/http2 https://wiki.mozilla.org/Networking/http2 "There is a separate, more experimental, build available that supports HTTP/2 draft-12 for http:// http:// URIs using Alternate-Services (-01) and the "h2-12" profile. Sometimes this is known as opportunistic encryption. This allows HTTP/2 over TLS for http:// http:// URIs in some cases without verification of the SSL certificate. It also allows spdy/3 and spdy/3.1 for http:// http:// URIs using the same mechanism. "
  - dragonwriter 12y ago
    I wasn't familiar with that, but that approach for HTTP URIs doesn't appear to be a spec requirement. Is there any indication that other browser vendors are going to follow that approach with HTTP URIs?

4 ms·

You are misunderstanding. The requirement for CA-issued certificates and most of the other things you are ranting about will still be only for HTTPS, which will

by dark_photon 12y ago

dragonwriter 12y ago
> HTTP URIs in HTTP/2 will only need self-signed certificates which can be generated automatically by the server. Where in the spec is there anything that HTTP URIs in HTTP/2 require any kind of certificate? Anyhow, I think its moot because all of the major browser vendors that have committed to HTTP/2 support have also announced they will support it only for HTTPS URIs, so what HTTP URIs require really only matters for non-browser HTTP-based applications that plan to use HTTP/2.
- dark_photon 12y ago
  > they will support it only for HTTPS URIs No. They may do that now but the intention is to support HTTP URIs that force TLS but allow self-signed certificates. See https://wiki.mozilla.org/Networking/http2 https://wiki.mozilla.org/Networking/http2 "There is a separate, more experimental, build available that supports HTTP/2 draft-12 for http:// http:// URIs using Alternate-Services (-01) and the "h2-12" profile. Sometimes this is known as opportunistic encryption. This allows HTTP/2 over TLS for http:// http:// URIs in some cases without verification of the SSL certificate. It also allows spdy/3 and spdy/3.1 for http:// http:// URIs using the same mechanism. "
  - dragonwriter 12y ago
    I wasn't familiar with that, but that approach for HTTP URIs doesn't appear to be a spec requirement. Is there any indication that other browser vendors are going to follow that approach with HTTP URIs?