I'm trying to change from a Let's Encrypt certificate to a self-signed certificate (I didn't know you could use self-signed).
When I changed my cert Lagrange gave an error that the cert was not one it trusted and the server didn't announce a change.
Does Gemini have a way to announce a cert change that I didn't know about? Any help here would be appreciated. Thanks!
1 year ago
I would recommend a self-signed 10+ year certificate for Gemini. TOFU is the method suggested in the spec, but because this is up to clients to decide I would assume many don鈥檛 do CA-based verification.
The worst situation in general is when a capsule has a scheduled renewal a la Let鈥檚 Encrypt, because visitors will then have to be constantly re-trusting the certificate, except for those who support CA verification. 路 1 year ago
@skyjake Thanks so much! Last question, in your opinion is it better to use a CA or self-signed cert or is it the same? Coming from the web this experience is unusual to me so wanting some opinions. 路 1 year ago
1) Yes, but only if the trusted root CA certs have been configured in Preferences > Network. In the latest version the prebuilt binaries have these built-in, but otherwise it鈥檚 up to user to provide the root certs.
2) Yes, normal TOFU. 路 1 year ago
@skyjake: Thanks! Couple of more questions so I understand the nuance:
1. Does Lagrange automatically trust changed CA certs?
2. Does Lagrange trust self-signed certs when you visit for hte first time (not changed)?
I think (2) is probably "yes" because I've never seen the warning on sites I've visited before. 路 1 year ago
Lagrange doesn't automatically trust changed self-signed certificates. You'll always need to mark them as trusted manually via the Page Information dialog. 路 1 year ago
@skyjake Hm, not sure I follow. How does that cause Lagrange to accept the cert? 路 1 year ago
The protocol doesn't address this issue. Any announcements about certificate changes have to be made manually via other means, like posting here on Station. 馃檪
I think usually people make a gemlog post about the change and submit the post to Antenna. 路 1 year ago