« first day (3039 days earlier)      last day (457 days later) » 

12:53 AM
I don't like rustls choice but that so simpler to use as rust user
 
 
1 hour later…
2:03 AM
Which are you talking about? Compiling crates that depend, or actually directly using? Never tried the latter. If the former, I actually find that reasonable for openssl, as long as you're not going for a cross-compiled statically linked something.
 
rustls is very strict on their ssl behavior
for example it's prevent self signed certificate to work
doing a simple tls tunel with rustls is hard as fuck
rustls is not at all user friendly
and so must not user friendly that it would either push user to use openssl instead, either do unsafe and manally thing with rustls doing maybe something wrong, either not use tls/ssl
rustls using webpki make it way too WEB centric. like their think tls and ssl is only for https world
but you know some people just want use simple self signed certificate
 
 
8 hours later…
10:03 AM
My understanding was that you could _choose_ which certificate store to use, and rustls can also use the native store as a default instead of the webpki one, or you can manually point it to a store.

Wouldn't either solve the self-certificate issue?
 
@MatthieuM. nope, rustls simply refuse it, you must do your own implementation of cert verification to do so
> only slightly more work
best way to handle an issue the dtolney way:
> This conversation has been locked and limited to collaborators.
 
10:25 AM
I don't see a "refusal" in the linked PR; they explicitly mention that you can create your own CA, add it to the store of trusted CAs, and use it to generate a Cert that will then work.

That's a bit more cumbersome -- certainly -- but the end result is the same, isn't it?
 
11:18 AM
@MatthieuM. that not what self signed cert is
and I tried many time to do a root CA
it's WAY TOO HARD
I never really succeeded to do it properly, one time it's worked but I got lost somewhere and I fail to reproduce the success
root ca is no joke
cause this imply intermediate ca
and a LOT of config you have no idea what you are doing
 
11:42 AM
I don't disagree it may be difficult -- and it's way outside my realm of expertise -- however the very comment you link seem to imply that you can go from root CA to "end-entity" cert in one step.

I wonder if the best way to handle this would be to ask the rustls guys to publish a recipe on how to create a cert for local usage that rustls will accept. They could even test the recipe in their own test-suite to ensure it remains up-to-date.
 
11:54 AM
honestly I will brague a little but if me I have trouble with this (thus I hate adminsys..) I expect A LOT of people would have no idea how to do it. There is already a number of issue asking for help, but not much is done, I don't blame rustls for the difficult of make a certificate, but I blame rustls to not make think user friendly for doing a simple one to one tls tunnel. When you have a server you setup up sshd, you connect to it using a simple tls tunnel, there is no root ca, it's easy
root ca don't exist for making a simple tunnel, their exist for one entity can trust many in a large scale like... the web, some entity have root ca that their use to secure a large among of service, self signed certificate have been create for a good reason, you don't need root cert for every thing
I should be able to simply with rustls to allow a list of self certificate public key that I trust.
but to do this you need to implement a trait yourself, make the verification of the key yourself, and that quite hard and error prone, and you lost a number of feature
 
 
1 hour later…
1:03 PM
You're making a lot of sense.

I can also understand that rustls maintainers would rather keep the scope constrained on their end. Part of the issue with OpenSSL was that it implemented every feature under the sun, with some being more or less maintained, and contortions done to try to make things flexible enough. The end result was a mess, partly because of the inherent complexity of juggling all the competing requirements. For security-sensitive stuff, flexibility and complexity are harmful.
 
1:39 PM
posted on February 08, 2023 by Jan David Nose

On Wednesday, 2023-01-25 at 09:15 UTC, we deployed changes to the production infrastructure for crates.io. During the deployment, the DNS record for static.crates.io failed to resolve for an estimated time of 10-15 minutes. Users experienced build failures during this time, because crates could not be downloaded. Around 9:30 UTC, the DNS record started to get propagated again and by 9:40 UTC tr

 

« first day (3039 days earlier)      last day (457 days later) »