34
Could mTLS be used instead to force the browser to validate the correct cert?
Not directly, but I believe mTLS would break if the traffic was intercepted/altered, so it sort of works to test the connection.
mTLS requires installing a certificate on the client device, though. If you're able to do that, then you're also able to pin the correct cert or install a custom CA. This would be the "enterprise" solution, as far as I know, but doesn't work well for public sites, since you can't always configure your end-users devices.
Edit: mTLS is still very useful, though. I use it to secure some of my services. It just doesn't solve this specific problem.
I'll add: mTLS would only break because the client certs are typically signed by a private CA and the host is configured to only trust that specific CA (similar to the enterprise solution I referenced in the post).
If, for some reason, the host was configured to trust all of the typical public CAs, then mTLS would theoretically share the same problem.
If there's a concern that an adversary can rewrite hashes then why is there not a concern the public key could also be rewritten and the hashes signed with the fake key?
There is.
this post was submitted on 18 Aug 2026
34 points (100.0% liked)
Selfhosted
61512 readers
643 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS