keybase / keybase/keybase-issues

Website verification only via HTTP even though I have CA installed locally

Open
#1,422 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

My website’s certificate is issued by [CAcert](http://www.cacert.org), a Web of Trust-based CA that’s not in most CA collections. When checking my proof (`keybase id lucaswerkmeister`), the client only does the verification over HTTP, even though I have the CAcert certificates installed on my system (e. g., `curl https://lucaswerkmeister.de/keybase.txt` works fine). It would be better if the client made that connection via HTTPS, at least on systems that have the certificate.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the issue with `keybase id lucaswerkmeister` and compare its HTTP verification with `curl https://lucaswerkmeister.de/keybase.txt`, which succeeds using the locally installed CAcert certificates. Trace the client’s website-proof verification path; done means HTTPS verification works when the system trusts the certificate, while existing verification remains functional otherwise.

Written by the indexing model from the issue text.

Assessment

Domain
networking, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.