keybase / keybase/keybase-issues
Website verification only via HTTP even though I have CA installed locally
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
My website’s certificate is issued by [CAcert](http://www.cacert.org), a Web of Trust-based CA that’s not in most CA collections. When checking my proof (`keybase id lucaswerkmeister`), the client only does the verification over HTTP, even though I have the CAcert certificates installed on my system (e. g., `curl https://lucaswerkmeister.de/keybase.txt` works fine). It would be better if the client made that connection via HTTPS, at least on systems that have the certificate.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the issue with `keybase id lucaswerkmeister` and compare its HTTP verification with `curl https://lucaswerkmeister.de/keybase.txt`, which succeeds using the locally installed CAcert certificates. Trace the client’s website-proof verification path; done means HTTPS verification works when the system trusts the certificate, while existing verification remains functional otherwise.
Written by the indexing model from the issue text.
Assessment
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100