<![CDATA[Does anyone know of Mastodon servers that use outbound RFC9421 HTTP-Signatures ?]]>Does anyone know of Mastodon servers that use outbound RFC9421 HTTP-Signatures ?

According to the release notes, version 4.5 should have it enabled by default for outgoing requests using the double knocking mechanism, but so far I haven't seen any request containing them...

]]>https://bb.devnull.land/topic/cdfcc4e9-8247-468a-b227-33949eed5cd0/does-anyone-know-of-mastodon-servers-that-use-outbound-rfc9421-http-signaturesRSS for NodeSun, 17 May 2026 13:33:53 GMTFri, 10 Apr 2026 12:52:44 GMT60<![CDATA[Reply to Does anyone know of Mastodon servers that use outbound RFC9421 HTTP-Signatures ? on Fri, 10 Apr 2026 15:47:16 GMT]]>@mariusor still, that's *massive*.

]]>https://bb.devnull.land/post/https://cosocial.ca/users/evan/statuses/116381190534948978https://bb.devnull.land/post/https://cosocial.ca/users/evan/statuses/116381190534948978Fri, 10 Apr 2026 15:47:16 GMT<![CDATA[Reply to Does anyone know of Mastodon servers that use outbound RFC9421 HTTP-Signatures ? on Fri, 10 Apr 2026 14:54:16 GMT]]>@julian the question stemed from me working on the RFC9421 support in 🙂

I was curious if I can do some quick debugging on my servers with some existing, widely used, implementation.

@evan

]]>https://bb.devnull.land/post/https://metalhead.club/users/mariusor/statuses/116380982110578162https://bb.devnull.land/post/https://metalhead.club/users/mariusor/statuses/116380982110578162Fri, 10 Apr 2026 14:54:16 GMT<![CDATA[Reply to Does anyone know of Mastodon servers that use outbound RFC9421 HTTP-Signatures ? on Fri, 10 Apr 2026 14:51:15 GMT]]>@mariusor @evan I'm not sure how they tested it, but I was also under the impression that it was finished.

I had a thread on the topic a few days ago, got some informative replies: https://activitypub.space/topic/912fb573-4db3-44ba-a886-daed413b6769/could-be-potentially-nice-for-fediverse-server-testing-as-more-implementations-make-the-jump-to-final-rfc-9421-http-signatures.

]]>https://bb.devnull.land/post/https://fietkau.social/users/julian/statuses/116380970237442786https://bb.devnull.land/post/https://fietkau.social/users/julian/statuses/116380970237442786Fri, 10 Apr 2026 14:51:15 GMT<![CDATA[Reply to Does anyone know of Mastodon servers that use outbound RFC9421 HTTP-Signatures ? on Fri, 10 Apr 2026 14:51:07 GMT]]>@evan hmmm, I looked at the PR mentioned in that bullet point and I think it might be for accepting incoming RFC9421 signed requests, not using them for outbound ones to other servers...

]]>https://bb.devnull.land/post/https://metalhead.club/users/mariusor/statuses/116380969681204112https://bb.devnull.land/post/https://metalhead.club/users/mariusor/statuses/116380969681204112Fri, 10 Apr 2026 14:51:07 GMT<![CDATA[Reply to Does anyone know of Mastodon servers that use outbound RFC9421 HTTP-Signatures ? on Fri, 10 Apr 2026 13:59:03 GMT]]>@evan maybe it's not true, but that's how I interpreted this release note:

https://github.com/mastodon/mastodon/pull/36635#:~:text=Change%20support%20for%20RFC9421%20HTTP%20signatures%20to%20be%20enabled%20unconditionally

]]>https://bb.devnull.land/post/https://metalhead.club/users/mariusor/statuses/116380764930795717https://bb.devnull.land/post/https://metalhead.club/users/mariusor/statuses/116380764930795717Fri, 10 Apr 2026 13:59:03 GMT<![CDATA[Reply to Does anyone know of Mastodon servers that use outbound RFC9421 HTTP-Signatures ? on Fri, 10 Apr 2026 12:53:25 GMT]]>@mariusor wow, I didn't know that. Great news.

]]>https://bb.devnull.land/post/https://cosocial.ca/users/evan/statuses/116380506839444933https://bb.devnull.land/post/https://cosocial.ca/users/evan/statuses/116380506839444933Fri, 10 Apr 2026 12:53:25 GMT