4 ms·
As someone who doesn't know much about the inner workings of the whole TLS stack, why is this surprising? I know in the past I've self-signed certificates for d
by apetresc 10y ago
As someone who doesn't know much about the inner workings of the whole TLS stack, why is this surprising? I know in the past I've self-signed certificates for domains that only existed on my LAN. Why couldn't that be the case here? Why shouldn't a central signing authority issue certificates for people's intranets?
- mbilker 10y agoI could sign a certificate for 'johndoe.com' without proper verification or I am using it in my local intranet. Let's Encrypt requires external verification to ensure certificates like this one and other miscellaneous certificates are issued.
- hug 10y agoThe answer is the same as the reason x509 "works" at all. The CAs don't issue invalid certs because if they did, they wouldn't be trusted anymore. In terms of technical limitations, nothing stops any CA from issuing any cert they want. It's the business consequences that stop them from doing so. If Let's Encrypt wants to keep themselves on the trusted-root-CA list of Windows, Chrome, MacOS, et. al., they need to keep their noses clean.