@benjojo nice talk, i am once more boggling at google chrome

i have read somewhere that microsoft edge downloads root certs on demand, dunno if it does that for intermediate certs too…

@fanf @benjojo In theory I think you can often download intermediates if you want to, because I believe many TLS certificates have an embedded 'Issuing Certificate URL'. Of course there are various issues with fetching random URLs during TLS certificate validation, so I can understand why browsers could well nope out of doing so.

@benjojo Yes! These missing intermediate certificates are my personal pet peeve! This is especially a problem since I usually create a new Firefox profile for each window, which then lacks many of the "usual" intermediate certificates, and therefore I get many more SSL errors. And in many cases these SSL errors do not occur for the website operators, making it really difficult to convince them that they need to fix something on their side.

@benjojo anything bigger than third-party CA existence ?

@benjojo I had setup "A bad TLS server" and only figured out it was a problem when my e-reader couldn't validate the cert.

@benjojo Appreciate you taking the time to create a text version of your talk!

What about needlessly including the Root CA in the cert bundle sent by the browser? I see it included in the “full chain” all the time, but I’m always careful to remove it, since it seems to me like any extra data sent during the initial part of a TLS connection will have a bigger impact because of TCP slow start…

@benjojo great talk! Never have thought of this before.