6 ms·
On one side, the CA certificate network forces a different kind of trust than SSH certificates. With a CA cert, you trust the browser company, and (sometimes) d
by stephengillie 10y ago
On one side, the CA certificate network forces a different kind of trust than SSH certificates. With a CA cert, you trust the browser company, and (sometimes) distrust the host. With SSH, the choice is only whether or not you trust the host.
(Please note Windows uses a similar cert for RDP, with the same options to trust once, trust forever, or disconnect immediately.)
Certificate Transparency is almost a type of blockchain, where what's stored is a website's decryption key.
- praseodym 10y agoIn Windows, one can use a certificate signed by the internal enterprise CA for RDP. This means that if one trusts the enterprise CA (which is the case within an enterprise), all internal RDP connections are immediately verified without prompts.
- deleted 10y ago[deleted]
- Edmond 10y agoMinor nitpick/correction: certificates are public keys, not decryption keys. Also you can only encrypt with a public key and decrypt with a private key or sign with a private key and verify with a public key. In general the CA PKI is mainly for endpoint (mainly server) authentication, actual encryption typically uses symmetric keys.
- 0x0 10y agoTo nitpick, OpenSSH does offer a CA-based approach as well. Perhaps not as commonly used as regular host and client keys, though.