cmbuckley

6 ms·

1. 1.▲
   by cmbuckley 6y ago

   That’s not the case — all certs are cross-signed with a newer root. The real problem is that certificate issuers have been giving people the old CA chain instead of the new one.
2. 2.▲
   by cmbuckley 6y ago

   Certificates issued with this CA will have been cross-signed by the newer root certificate, but our CA (Sectigo) was sending the old chain in issuing emails as late as April this year, despite the cross-signed root being available for a lon
3. 3.▲
   by cmbuckley 6y ago

   Well yes, of course you can do that. But at that point, why would you reference third-party font URLs, instead of self-hosting them? (The article pretty much begins by stating that this is the fastest option.) If performance is your utmost
4. 4.▲
   by cmbuckley 6y ago

   The fonts are static, but the CSS (from fonts.googleapis.com), and the font files it references, vary depending on the User-Agent. For instance, with a Chrome UA it will request WOFF files; with a blank UA it may request TTF files.
5. 5.▲
   by cmbuckley 8y ago

   It doesn't seem to be caused by that, I've seen the error with and without the /birthday suffix. It looks to be related to missing data from one of the GraphQL responses.