[tor-talk] is Torbrowser more affected by webservers failing to send their complete certificate chain?

[nusenu]

Hi,

I assume that Torbrowser users are more affected by webservers 
that do not send their complete certificate chain (incl. interm. CAs)
due to the fact that torbrowser stores/caches less data (including certs?) persistently.


an example of a page that results in an TLS error page in Torbrowser due to incomplete cert. chain:
https://irtf.org/ 

https://www.ssllabs.com/ssltest/analyze.html?d=irtf.org&s=2001%3a1900%3a3001%3a11%3a0%3a0%3a0%3a2c&hideResults=on&latest


With the growing number of sites deploying HSTS, the impact is even bigger.

Should Torbrowser ship a few common interm. CAs by default? (like the letsencrypt issuing CAs)



-- 
https://twitter.com/nusenu_
https://mastodon.social/@nusenu

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.torproject.org/pipermail/tor-talk/attachments/20180807/95a84bd2/attachment.sig>