Tell HN: Sci-Hub's TLS certificate has started failing

Re:Tell HN: Sci-Hub's TLS certificate has started failing by ams6110 on Sunday April 29, 2018 @12:57PM (#16952796)

Self-signed certificates, trust on first use (or verify out of band) like SSH, works around most of this

[ Parent | on HN ]

Re:Tell HN: Sci-Hub's TLS certificate has started failing by ethbro on Sunday April 29, 2018 @01:13PM (#16952867)

Correct me if I'm wrong, but the signed server-identifying cert is swapped in TLS before the connection is encrypted, no?

So it's not technically infeasible to have networking gear drop any connection which doesn't chain back to a government-approved root?

[ Parent | on HN ]

Re:Tell HN: Sci-Hub's TLS certificate has started failing by cesarb on Sunday April 29, 2018 @03:13PM (#16953435)

> Correct me if I'm wrong, but the signed server-identifying cert is swapped in TLS before the connection is encrypted, no?

Only on old TLS versions. TLS 1.3 changed it so the server certificate is also encrypted.

[ Parent | on HN ]

Re:Tell HN: Sci-Hub's TLS certificate has started failing by catamorphismic on Tuesday May 01, 2018 @07:21AM (#16966103)

What about SNI?

[ Parent | on HN ]

Re:Tell HN: Sci-Hub's TLS certificate has started failing by userbinator on Sunday April 29, 2018 @01:31PM (#16952961)

So it's not technically infeasible to have networking gear drop any connection which doesn't chain back to a government-approved root?

Yse, and that is a very scary thought. China is doing something similar already.

[ Parent | on HN ]

Re:Tell HN: Sci-Hub's TLS certificate has started failing by ams6110 on Sunday April 29, 2018 @01:51PM (#16953050)

You could use a VPN. If you live in a place like China that blocks VPNs, you are screwed, agreed.

[ Parent | on HN ]