3 ms·
Yes, but 99.999% of web servers don't need client certs.
by cperciva 11y ago
Yes, but 99.999% of web servers don't need client certs.
- Tepix 11y agoSource?
- Natsu 11y agoOther than the government, nobody trying to do client certs actually runs the CA that issues them that I've seen. Instead, they trust some random set of commercial CAs, ignorant of the fact that openssl s_client -connect will dump out that list to any passer-by. I've even seen them trusting the "domain control validated only" certs, without any indication of "maybe this is a bad idea, because anyone who can buy a cert can auth to us because we don't even check." So for every case I've seen, they'd have been ahead to issue credentials themselves and just skip client certs.
- tedunangst 11y ago99.999% of web servers.
- aaronbrethorst 11y agoI think cperciva's opinion is a sufficiently valid source on this sort of issue, which is probably why you're being down voted.
- cperciva 11y agoThank you for the vote of confidence, but you're wrong. The question of "real world usage of TLS" is one where I would immediately defer to tptacek without question... and you've been around long enough to know that's something I don't do very often.
- marcosdumay 11y agoOf course. But they'll end up implementing it anyway, because of the 00.001%.