3 ms·

If you own a domain and have a webserver running ssl you can distribute your public key in a secure manner. What situations are you encountering in 2019 where

• jakeogh 8y ago
  It's almost like not needing to roll your own key distribution mechanism is a nice feature.
• zeveb 8y ago
  > If you own a domain and have a webserver running ssl you can distribute your public key in a secure manner. That means that I'd be trusting GUANG DONG CERTIFICATE AUTHORITY and every other CA not to issue a fraudulent certificate against my domain. I don't think that's very secure.
  • yjftsjthsd-h 8y ago
    Use a domain that requires certificate transparency and you're basically set.
  • jamieweb 8y ago
    Use a CAA policy in your DNS to lock down the CAs that can issue for your domain, and then monitor for issued certificates with the certificate transparency logs. In modern browsers, certificates are not trusted if they're not CT-logged, so it's impossible for a fraudulent one to exist without you knowing about it (unless it was issued before these requirements were put in place in ~April 2018, but once all of those have expired, it'll be a pretty solid system).
    • bmn__ 8y ago
      That still does not help against the GP's problem. The most practical – yet totally ridiculous – solution in 2019 is still: for each end user, for each browser, to delete all pre-trusted CAs, and reenable them one-by-one trust-on-first-use. In a few days to weeks, the user ends up with around six active CAs that are actually in use, instead of dozens inactive ones that are just a backdoor waiting to happen.
• taeric 8y ago
  You are just using a different web of trust. Specifically the SSL Certificate Authorities.