Path: csiph.com!aioe.org!.POSTED!not-for-mail From: =?UTF-8?Q?Arne_Vajh=c3=b8j?= Newsgroups: comp.lang.java.programmer Subject: Re: SSL trends Date: Sat, 24 Sep 2016 18:25:35 -0400 Organization: Aioe.org NNTP Server Lines: 41 Message-ID: References: NNTP-Posting-Host: 7SK6yTFfqwlIPNBLl3l7Qg.user.gioia.aioe.org Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-Complaints-To: abuse@aioe.org User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 X-Notice: Filtered by postfilter v. 0.8.2 Xref: csiph.com comp.lang.java.programmer:35641 On 9/23/2016 12:58 AM, Roedy Green wrote: > On Thu, 15 Sep 2016 20:18:10 -0400, Arne Vajhøj > wrote: >>> However there are a set of headaches that come with the transition. >>> 1. clients must have the root cert installed >> >> All normal browsers should have that. Not a problem. > > For example, you have to manually install the root certs for Gandi and > Let's encrypt. Also there are displutes with China. You have to > install some of them manually. I had to import 114 of them into > cacerts. Java's list is quite sparse. Browsers are kept uptodate automatically. Maybe Java is different. But don't expect the web to prioritize Java programs fetching pages. Browsers must outnumber Java programs by 4-5 orders of magnitude. >>> 2. certs expire > >> >> Should be handled via OS/browser updates. Nobody should surf >> the internet with a OS/browser that is not being updated. Not >> a problem > The problem is the people running the server fail to notice their cert > is about to expire. It takes them about a week get a new one. I > monitor quite a number of websites as part of looking for broken links > on my site. This is now the #1 cause of broken links. I email them. > They always seem surprised and even incredulous. That happens occasionally. But you can chose to accept anyway. Arne