Re:Hello HTTP/2, Goodbye SPDY
by dark_photon on Tuesday February 10, 2015 @02:51PM
(#9029445)
> they will support it only for HTTPS URIs
No. They may do that now but the intention is to support HTTP URIs that force TLS but allow self-signed certificates.
See https://wiki.mozilla.org/Networking/http2
"There is a separate, more experimental, build available that supports HTTP/2 draft-12 for http:// URIs using Alternate-Services (-01) and the "h2-12" profile. Sometimes this is known as opportunistic encryption. This allows HTTP/2 over TLS for http:// URIs in some cases without verification of the SSL certificate. It also allows spdy/3 and spdy/3.1 for http:// URIs using the same mechanism. "
Re:Hello HTTP/2, Goodbye SPDY
by dragonwriter on Tuesday February 10, 2015 @07:22PM
(#9030819)
I wasn't familiar with that, but that approach for HTTP URIs doesn't appear to be a spec requirement. Is there any indication that other browser vendors are going to follow that approach with HTTP URIs?
Where in the spec is there anything that HTTP URIs in HTTP/2 require any kind of certificate? Anyhow, I think its moot because all of the major browser vendors that have committed to HTTP/2 support have also announced they will support it only for HTTPS URIs, so what HTTP URIs require really only matters for non-browser HTTP-based applications that plan to use HTTP/2.