Hacker News new | ask | show | jobs
by noinsight 3289 days ago
> Client certs alone are good for authentication (don't work in HTTP/2 though)

Um, what? Did client certs get removed from HTTP 2?

2 comments

I have been collecting conflicting reports on HTTP/2 client certificate support:

14 months ago: "No. But TLS!" https://news.ycombinator.com/item?id=11556762

7 months ago: "421" https://news.ycombinator.com/item?id=13022596

Maybe it would be worth the time to test out the various implementations if someone has not already done so?

--

Doing some preliminary research, support is still a working draft https://datatracker.ietf.org/doc/draft-bishop-httpbis-http2-... source: https://daniel.haxx.se/blog/2016/08/18/http2-connection-coal...

Yes. As far as I understand, the problem was that the requirement for a certificate is a per-request thing, but HTTP 2 can have multiple requests in flight over the same TLS connection at the same time and thus can't just renegotiate the connection when it comes up. There have been proposals to fix this, but nothing has gained the necessary interest and traction.

Servers can ask the client to fall back to HTTP 1.1 instead, and then use client-certificates there.