Re:Verifying your Matrix devices is becoming mandatory
by treyd on Wednesday November 19, 2025 @08:26PM
(#45987653)
With PKI you're trusting a certificate chain up to a CA you already trust, by way of your OS or browser vendor.
A domain can layer on HSTS to that, which directs clients to additionally refuse to trust a new cert for a domain until the one you currently trust has expired.
Re:Verifying your Matrix devices is becoming mandatory
by scheub on Wednesday November 19, 2025 @10:20PM
(#45988514)
That’s not what HSTS does. It asks the client to remember that you want to only use TLS for that domain and refuse to use unencrypted HTTP in the future.
A domain can layer on HSTS to that, which directs clients to additionally refuse to trust a new cert for a domain until the one you currently trust has expired.