Client certificates

[Ciprian Dorin Craciun]

[Disclaimer:  I'm not directly involved in Gemini development or
ecosystem, but I follow closely these developments.]


On Mon, Apr 20, 2020 at 12:23 AM Julien Blanchard <julien at typed-hole.org> wrote:
> When trying to implement client certificate support in my client I
> wondered whether or not we would want to be able to use different
> certificates for different gemini places?

I would definitively want to have different "personas" for different
sites.  In fact even for the same site I would like to have different
ones, for example:  one for administrative purposes, and one for
normal (but authenticated) access.



> I figured why not so started I my implementation by searching for a
> certificate that matches the host domain name like
> astrobotany.mozz.us.key and astrobotany.mozz.us.crt.
> Does it make sense? Where should one put its certificates if such a
> place exists in a filesystem?


Automatically choosing a client certificate and presenting it to the
server, I believe is a bad idea from a privacy perspective.  I would
implement something like this:  when connecting to a domain for which
one could use a client certificate, ask the user the first time if he
wants to:
* always use the same certificate for that particular domain;
* wants to use a particular certificate (assuming there are multiple),
but prefers to confirm it for each new "tab" (or browsing context);
(i.e. sort of "last-used" but "confirm";)
* never use any certificate;

Ciprian.