News for hackers. Stuff that matters.

A comment on How I got a valid SSL certificate for my ISP's main domain. Parent comment

Re:How I got a valid SSL certificate for my ISP's main domain by yuhong on Saturday March 21, 2015 @01:38PM (#9243477)
Personally, I am for an overridable hard-fail option for OCSP, which should not be the default for now. What I want is an actual interstitial with an override option, because it will show before the HTTP request is sent.
[ Parent | on HN ]
Re:How I got a valid SSL certificate for my ISP's main domain by agwa on Saturday March 21, 2015 @01:43PM (#9243502)
How would users possibly know when it's safe to override an OCSP error?
[ Parent | on HN ]
Re:How I got a valid SSL certificate for my ISP's main domain by yuhong on Saturday March 21, 2015 @01:52PM (#9243543)
Yea, there always would be a risk, but the user can evaluate the situation and determine whether it would be acceptable. This is part of why I said it would not be enabled by default for now though.
[ Parent | on HN ]