@benjojo There are not just browsers! I want 'curl example.com' to works with plain HTTP.

@bortzmeyer @benjojo

Curl can also do HTTPS or just use --insecure (and don't tell me insecure HTTPS is less secure than plain HTTP).

@benjojo @bortzmeyer Kind of semi-offtopic, but that made me think: if you detect a credential sent over plaintext, revoke it from your side immediately (assuming you want to keep HTTP running). And wonder if anyone is actually doing it this way 🤔

@benjojo @bortzmeyer This is a very good reason to close port 80 on anything that gets authenticated non-browser traffic in particular, yes.

@benjojo I've seen retro-hardware enthusiasts locked out of the parts of the web because their software can still speak http, but not do modern encryption.

Not sure what the overlap is between people doing retro hardware and BGP.

@holsta @benjojo the only retro hardware we use is our network gear, not our laptops.

@benjojo
are you sure every browser uses https first?

Also I think search engines can have a problem with https only pages.

And the third problem that may be there: what happens with old links that go explicitly to http:// bgp.tools ?

@benjojo @flo In my experience, browsers on Windows somehow don’t always do that.
We have some internal websites that are port 443 only and every now and then we get issue reports from Windows users (with different browsers).

@benjojo And even the ACME use case might be not too relevant given https://letsencrypt.org/docs/challenge-types/#tls-alpn-01 and that one should try to avoid wildcard certs anyway?

@benjojo For bonus bonus points you could also drop in an HTTPS DNS record