Hacker News Reader

I hope this is just bad wording and not a setting that actually disables certificate validation? They can't possibly mean it will accept even invalid SHA1 certificates?

> security.pki.sha1_enforcement_level” to 0 (which will accept all SHA-1 certificates)

View on HN

Setting security.pki.sha1_enforcement_level to 0 will still only accept SHA-1 certs that are signed by a root CA in the NSS truststore. That setting only disables the SHA-1 deprecation logic.

As opposed to a tiered acceptance based on the issuance/expiry date of said certificate.

https://support.globalsign.com/customer/portal/articles/1447...

Reply on news.ycombinator.com