<story><title>The browser&apos;s biggest TLS mistake</title><url>https://blog.benjojo.co.uk/post/browsers-biggest-tls-mistake</url></story><parent_chain></parent_chain><comment><author>coffee--</author><text>It was years in the making for Firefox to be able to do &amp;quot;intermediate preloading&amp;quot; - we [0] had to make the policy changes for all intermediates to be disclosed, and then let that take effect [1].&lt;p&gt;Preloading like this shouldn&amp;#x27;t be necessary, I agree with the author, but worse than this is any bug report of &amp;quot;Works in Chrome, not in Firefox.&amp;quot; Prior to this preloading behavior shipping in Firefox 75, incorrectly-configured certificate chains were a major source of those kind of bugs [2].&lt;p&gt;[0] This was me (:jcj) and Dana
[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;wiki.mozilla.org&amp;#x2F;Security&amp;#x2F;CryptoEngineering&amp;#x2F;Intermediate_Preloading&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;wiki.mozilla.org&amp;#x2F;Security&amp;#x2F;CryptoEngineering&amp;#x2F;Intermed...&lt;/a&gt;
[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.mozilla.org&amp;#x2F;security&amp;#x2F;2020&amp;#x2F;11&amp;#x2F;13&amp;#x2F;preloading-intermediate-ca-certificates-into-firefox&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.mozilla.org&amp;#x2F;security&amp;#x2F;2020&amp;#x2F;11&amp;#x2F;13&amp;#x2F;preloading-inte...&lt;/a&gt;</text></comment>
<story><title>The browser&apos;s biggest TLS mistake</title><url>https://blog.benjojo.co.uk/post/browsers-biggest-tls-mistake</url></story><parent_chain></parent_chain><comment><author>dochne</author><text>It still remains a mystery to me why browsers felt they should &amp;quot;fix&amp;quot; this server misconfiguration.&lt;p&gt;It&amp;#x27;s particularly vexing to me as the main reason that people end up with misconfigured servers at all is because after they&amp;#x27;ve configured their new cert (incorrectly) their web browser gives them a tick and they think they&amp;#x27;ve done it right - after all, why wouldn&amp;#x27;t they?</text></comment>