Hacker News Reader

Comment by superkuh | Hacker News Reader

After looking around for ~5 minutes I still can't find out if this HTTP/3 lib will allow establishment of an HTTP/3 connection with a self signed cert. Or if it will allow non-encrypted connections. Does anyone know?

Given the lack of any function names addressing TLS/CAs/encryption/etc I'm going to assume it's like all the other HTTP/3 implementations and fails to fully implement the spec. It's funny. Everyone defends MS/Google's HTTP/3 based on QUIC by saying the lack of ability to use plain text or self signed certs is the fault of the HTTP/3 implementations. But all the HTTP/3 lib implementations say it's the fault of QUIC.

View on HN

> I'm going to assume it's like all the other HTTP/3 implementations and fails to fully implement the spec... the lack of ability to use plain text or self signed certs

Really? Does trusting a self-signed cert as a root cert not work in most libraries? quiche at least lets you control the parameters of their TLS implementation (https://docs.quic.tech/quiche/struct.Config.html#method.with...), which lets you go as far as allowing you to manually verify certs yourself (https://docs.rs/boring/latest/boring/ssl/struct.SslContextBu...).

Where in the HTTP/3 spec does it allow for non-encrypted connections? HTTP/3 is a mapping of HTTP semantics to QUIC specifically, and QUIC mandates TLS 1.3 negotiation.

Also quiche supports self-signed certificates (I use it with them). In fact I'm not aware of any raw QUIC or HTTP/3 implementations that don't allow implementing your own certificate handling.

Considering you can't run nginx with http/2 unless you specify SSL, I'd say TLS/SSL is a requirement with this library.

> Given the lack of any function names addressing TLS/CAs/encryption/etc

Not only in its public API, but those are missing from its source code as well. I can't see where it could be doing any encryption—it doesn't even link to e.g. OpenSSL.

I don't think this is a free-standing implantation. The docs start with:

> nghttp3 is a thin HTTP/3 layer over an underlying QUIC stack.

Just create your own root CA and pin it in the clients.

How do I host a website visitable by random people I've never met on HTTP/3 without getting the continued/periodic approval of a third party corporation for a CA based TLS cert? I can't. That's bad. It's a very significant change from HTTP/1.1 (HTTP/2 is only used by corporations/institutions/non-human persons) in the past which allowed anyone to connect to anyone. It was truly a web.

There's absolutely no way I can get my self-made root cert in the trust store of the major browsers so that a random person I've never met can connect. HTTP/3 is designed for the use cases of non-human persons. For human persons it's a terrible protocol.

Reply on news.ycombinator.com