#1061: Certificate failure --------------------------------------+------------------------------------- Reporter: eschnett | Owner: Type: enhancement | Status: reopened Priority: minor | Milestone: Component: EinsteinToolkit website | Version: Resolution: | Keywords: --------------------------------------+-------------------------------------
Comment (by eschnett):
If we require action from the end user, then we may as well skip certificates, which are supposed to automate this process. The information on Trac is not important enough to be worried about attackers; I'd rather clean up a bit more spam than have to explain people how to disable the security measures we put into place.
As Ian mentioned, we are probably not the only group facing this issue. Large web sites (Google, Amazon, etc.) know how to use certificates in such a way that end users don't receive warnings. I don't care about the technical issues, or how they can be solved with or without root access by the end user. We are paying for a service, and that service is to authenticate us (our server) to our visitors. If this doesn't work, then we paid too much. It's the CA's task to ensure that sufficiently many end users have received their certificate via OS updates or some other mechanism, and if that process takes five years, so be it -- apparently, a root certificate lives for ten years, so there's no problem.
If someone uses a "too-new" root certificate for signing a web site, then this seems rather like a rookie mistake to me.