So I just ordered the cheapest AP I could find.
Except the damn device worked perfectly. Slow but rock solid.
One of our testers at $CURRENT_JOB also has trouble simulating a crap network, because our network is good.
Unless it's for a custom physical device, then uh. idk. Probably something, proxying through another computer that is hosting a separate wifi network? But likely a lot harder.
Firefox Beta (150.0b7) is accepting all of the revoked certs on my device
Just "add your own crypto" on top, which is the ONLY thing a sane person would do.
3... 2... 1... banned?
The payload that implements your crypto cannot be delivered over http, because any intermediate party can just modify your implementation and trivially compromise it.
If you don't trust TLS, you have to pre-share something. In the case of TLS and modern browser security, the "pre-shared" part is the crypto implementation running in the browser, and the default trusted store of root CAs (which lives in the browser or OS, depending).
If you want to avoid trusting that, you've got to distribute your algorithm through an alternative channel you do trust.
Work in progress, that said presharing solves enough for the world to dump DNS and HTTPS in a bin and light it on fire now because nobody has the power to implement all the MITM needed if everyone "makes their own crypto"!
Circular arguments and all...