Hacker News new | ask | show | jobs
by hsbauauvhabzb 676 days ago
So we’re back to trusting the user?
1 comments
0l 675 days ago
Use HSTS, browsers are specifically designed not to let users bypass these.
link
hsbauauvhabzb 675 days ago
Hsts forces encryption, it has no impact on certificate invalidity, at least to my knowledge.
link
0l 675 days ago
Visit your .internal site -> website uses TLS cert signed by root CA that is preloaded on your device. Succeeds and HSTS flag is set.

Visit other .internal site -> uses TLS cert NOT signed by root CA that is preloaded on your device -> certificate error, and cannot be bypassed due to HSTS.

link