Comment on Decreasing Certificate Lifetimes to 45 Days

• atzanteol@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago

  You don’t need to if you’re just using things locally.

  source

  • WhyJiffie@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago

    yes you need if you want HTTPS that is accepted by the smartphone client apps of your services.

    domains are a constant expense

    source

    • atzanteol@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago

      They’re cheap. You can also generate your own certs and use your own ca. But otherwise yes - quit yer bitching and learn how to do things right.

      source

      • WhyJiffie@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago

        You can also generate your own certs and use your own ca.

        I do this, with a custom root cert, but it has problems. some apps don’t accept it, some only accept it by totally disabling cert verification.

        installation is also very cumbersome: you go to a weird, badly structured menu on your phone deep in the settings, and select the certificate from storage where apps could have had replaced it while you were navigating the menu.
        it does not ask you for confirmation, does not show anything important about the cert, like its fingerprint you could use to quickly check its not been modified, any name constraints, validity period, etc. users cannot tell what that cert will grant its creator, because the system does not tell them anything so that they could decide, other than a generic “your connection may be monitored” message at all times. and when they refuse to install your cert, they are right, because this way it is very risky.

        so please tell me “how to do things right”, or shut up if you can’t tell any useful info

        source