3 ms·
Because certificates are about identity verification as well as encryption. If a site doesn't have a certificate , there's no identity verification at all and
by Veen 10y ago
Because certificates are about identity verification as well as encryption.
If a site doesn't have a certificate , there's no identity verification at all and whether or not to trust the site is left up to the user.
If it does have a certificate, and the certificate doesn't appear to be validated by a CA for the domain or organization, or whatever, then there's a risk of misplaced trust. Anyone can issue a certificate for any domain, but they're only "trustworthy" if they've been signed by a CA.
- pdkl95 10y ago> Because certificates are about identity verification as well as encryption. That's the problem. Why are you deriving trust from a self signed certificate? The UI should be similar to plaintext if there isn't a verifiable chain of trust. There isn't any issue of misplaced trust if you aren't actually labeling the connection as trusted. > Anyone can issue a certificate for any domain No, they can issue a certificate that allows for encrypted communication with the current host. Trusting a self signed certificate for any other purpose would be a serious bug.