Comment by 🦂 zzo38
Re: "[#147] Client certificate trust level"
I had the idea of using a certificate chain; you can use one certificate to issue another certificate to yourself, and include an extension (specific to the service that you are connecting to) to specify the permissions that are granted by the certificate; the server must then check the value of that extension for all certificates in the chain, and only grants permissions that all certificates in the chain allow. (This would be much better than most of the existing WWW auth stuff, in my opinion)
(I had written elsewhere about many oter advantages of using X.509 client authentication; the way that most Gemini services currently use it does not provide the full advantages but only one of them. A lot more is possible, even if using self-signed certificates, or if using certificates issued by the server which has its own root certificate (without needing any other kind of centralized authority).)
2025-11-03 · 6 months ago
Original Post
When a user has multiple certs, it could be useful to mark some of them as "low-trust". When using such a cert, revoking any of the user's certs would be prevented and recovery settings could not be accessed (password, recovery URL). One situation where this is useful is when certs are stored on a device where the keys are readily accessible, e.g., an e-reader you can just plug into a computer to get full file access. A mechanism to elevate access rights on a low-trust certificate would be...