Re:Why HTTP/3 is eating the world
by superkuh on Thursday October 05, 2023 @03:38PM
(#37783269)
Yeah, it's difficult for me to always add the qualifer, "HTTP/3 allows self-signed certs but no implementation that exists in any browser allows self signed certs".
[ Parent
| on HN ]
Re:Why HTTP/3 is eating the world
by paulddraper on Thursday October 05, 2023 @03:52PM
(#37783445)
The original comment was opposition to HTTP/3 because of mandatory secure connections.
In reality, the opposition is misdirected; it is Chrome that requires secure connections, not HTTP/3.
Plenty of browsers allow self-signed certs—Firefox and Safari, to the best of my knowledge, treat HTTP/3 certs exactly the same as they treat HTTP/2 and HTTP/1.1 certs. Chrome has taken the position that it will no longer allow self-signed Root CAs for HTTP/3 websites, to prevent SSL interception with companies intercepting all of your traffic. For personal use, you can always whitelist an individual certificate using a CLI flag without allowing a trusted root CA
My testing in the past seems to indicate you're wrong. Firefox does not support setting up HTTP/3 connections without CA TLS. Unless they've changed it since version 115 esr. While the neqo lib they use for HTTP/3 does technically allow it unless you compile it yourself with all the flags required for it FF ships with neqo having CA TLS required and no support for self-signed certs when setting up HTTP/3 connections.
I'd love to be wrong or shown a newer version that does allow these things. It'd be a huge load off my mind.