Comment on Don't Trust, Verify (or: Validating Origin and Integrity without Public CAs)
min@lemmy.sdf.org 6 days ago
Could mTLS be used instead to force the browser to validate the correct cert?
Comment on Don't Trust, Verify (or: Validating Origin and Integrity without Public CAs)
min@lemmy.sdf.org 6 days ago
Could mTLS be used instead to force the browser to validate the correct cert?
K3can@lemmy.radio 6 days ago
Not directly, but I believe mTLS would break if the traffic was intercepted/altered, so it sort of works to test the connection.
mTLS requires installing a certificate on the client device, though. If you’re able to do that, then you’re also able to pin the correct cert or install a custom CA. This would be the “enterprise” solution, as far as I know, but doesn’t work well for public sites, since you can’t always configure your end-users devices.
K3can@lemmy.radio 6 days ago
I’ll add: mTLS would only break because the client certs are typically signed by a private CA and the host is configured to only trust that specific CA (similar to the enterprise solution I referenced in the post).
If, for some reason, the host was configured to trust all of the typical public CAs, then mTLS would theoretically share the same problem.