{"type":"rich","version":"1.0","author_name":"npub17ty4mumkv43w8wtt0xsz2jypck0gvw0j8xrcg6tpea25z2nh7meqf4qgyd","author_url":"https://nostr.ae/npub17ty4mumkv43w8wtt0xsz2jypck0gvw0j8xrcg6tpea25z2nh7meqf4qgyd","provider_name":"njump","provider_url":"https://nostr.ae","html":"📅 Original date posted:2012-11-26\n📝 Original message:Obviously this LGTM :)\n\nMinor caveat, IMHO we should support all CAs used by the popular\nbrowsers. This ensures no merchant ever finds that their SSL cert they\nalready own is OK for the web but not for Bitcoin. I don't see a need\nto be stricter here, given all it achieves is signing some data in a\nway linked with a domain name.\n\nX.509 is pretty baroque indeed, for our use cases it'd not be hard to\ndo better. In particular, the inability to delegate properly rather\ndefeats the benefits of chained certificates. For the payment\nprocessor case what you really want to do is take your keys, then\nissue a new cert that is specific to signing Bitcoin transactions and\ngive that to the payment processor secure in the knowledge that they\ncannot MITM your secure connections. Unfortunately X.509 wasn't\ndesigned for the web and thus certificates you buy are marked such\nthat they are not allowed to sign for other certs (due to lack of real\nnamespace support).\n\nThis leads to the idea of redefining the cert chain part of the\nprotocol like this:\n\n  repeated bytes x509_chain = 1;\n\nbecomes\n\n  message Certificate {\n    enum Type {\n      X509 = 1;\n    }\n    required Type type = 1;\n    required bytes data = 2;\n  }\n\n  repeated Certificate cert_chain = 1;\n\nThen if later we want to introduce our own minimal certificate formats\nwhich include features we want, we can add new enum types to do so.\n\nNote that if an old client encounters an invoice with a cert type it\ndoesn't recognize, it will abort parsing of the message entirely. So\nthe request to download the invoice should probably include a protocol\nversion number of some kind so the server knows when it's safe to use\nnew invoice features."}