3 ms·
"because any CA can attack you, whether you're their customer or not" Can you (or someone) explain why this is? I don't understand.
by philbarr 11y ago
"because any CA can attack you, whether you're their customer or not"
Can you (or someone) explain why this is? I don't understand.
- pfg 11y agoEvery CA in your trust store can issue certificates for every domain. "Attack", in this context, means issuing a trusted certificate that can be used to MitM users of your site. HPKP helps mitigate this risk on a Trust on First Use (TOFU) basis.
- netheril96 11y agoAs long as the certificate is ultimately signed by a root CA in your computer's trust store, the certificate will be regarded as valid by your computer. So basically, any CA in your trust store or signed by a CA in your trust store can issue the certificates for anyone, anything and any domain. It doesn't matter if the owner of domain consents or not.