WebTransport serverCertificateHashes option

Category: Network / Connectivity
Type: Chromium catches up
Status: Enabled by default (Chrome 100)
Intent stage: Shipped

Breaking change: No
Enterprise impact: None
Chromium flag: WebTransportCustomCertificates
Spec maturity: Working draft
Web Platform Tests: No

WPT details: WebTransport itself is tested by web-platform-tests; this specific feature requires infra support that is currently not available <https://github.com/web-platform-tests/wpt/issues/32463>.

Summary

In WebTransport, the serverCertificateHashes option allows the website to connect to a WebTransport server by authenticating the certificate against the expected certificate hash instead of using the Web public key infrastructure (PKI). This feature allows Web developers to connect to WebTransport servers that would normally find obtaining a publicly trusted certificate challenging, such as hosts that are not publically routable, or virtual machines that are ephemeral in nature.

Standards & signals

Specification: https://w3c.github.io/webtransport/#dom-webtransportoptions-servercertificatehashes
Firefox: Positive
Safari: No signal
Web developers: Positive — Some developers have indicated that this would be a prerequisite for them to switch from WebRTC to WebTransport.

Ecosystem

Web Platform Tests: https://wpt.fyi/results/?q=webtransport-servercertificatehashes-option
Chrome Platform Showcase: https://chrome-platform-showcase.paulkinlan-ea.deno.net/features
GenDN reference: https://gendn.paulkinlan-ea.deno.net/features
chrome.dev demos search: https://www.google.com/search?q=site%3Achrome.dev+WebTransport%20serverCertificateHashes%20option
MDN Web Docs: https://developer.mozilla.org/en-US/search?q=WebTransport%20serverCertificateHashes%20option
Baseline status: https://webstatus.dev/?q=WebTransport%20serverCertificateHashes%20option

View on chromestatus.com