Stefan Eissing on nostr

That CAs are no longer allowed to issue client certificates was announced about a year ago.

This is not enough time for some, even though LE bravely help push that date to July this year.

Now, Apache httpd is asked to add a switch to disable checking of the certificate purpose bits.

Not sure if we want that. It'll probably then stay in use forever?

https://bz.apache.org/bugzilla/show_bug.cgi?id=70003

the tower fairy · 16w

nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq7qes6mstpcsn6rg3w9fwnsau68sw9h9nga9zjy3htmegg27na6wsjd3n63 The actual bug report is not publicly available?

truh · 16w

nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq7qes6mstpcsn6rg3w9fwnsau68sw9h9nga9zjy3htmegg27na6wsjd3n63 the bugzilla link requires login.

Stefan Eissing · 16w

That is the report from today. https://assets.chaos.social/media_attachments/files/116/420/542/172/811/463/original/bf1fb99f654615aa.png

Hynek Schlawack · 16w

nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq7qes6mstpcsn6rg3w9fwnsau68sw9h9nga9zjy3htmegg27na6wsjd3n63 it feels like nobody really thought this whole thing thru? I work at a domain registrar and most registries require client certificates. Some will give you one, others will allow you to ...

daniel_ferradal_marquez · 16w

nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq7qes6mstpcsn6rg3w9fwnsau68sw9h9nga9zjy3htmegg27na6wsjd3n63 shouldn't we just issue a default or recommended,express the concerns in the docs and let everyone decide on their own after that?

Klaus Frank · 16w

nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq7qes6mstpcsn6rg3w9fwnsau68sw9h9nga9zjy3htmegg27na6wsjd3n63 Well the argument was that client certificates should identify endusers exclusively. So it is just consequent to have that flag if you want the other end of the TLS connection to also be...