3 ms·

But certificates are PUBLIC keys...

• majewsky 8y ago
  It's evident that GP is referring to the private keys.
  • mholt 8y ago
    No, it's not.
• 420codebro 8y ago
  Let's say a single VM or docker container has a break-out exploit. They get the private key for (whatever).domain.tld. It would be nice to be able to issue whatever yourself, rather than having to A) do wildcards or B) expose every single record to CT. But I personally don't tie privacy to DNS. Best systems I've seen which handle sensitive stuff have very ambiguous DNS names which you would never guess what they really are.
• tracker1 8y ago
  And how would one use the cert on a server for a secure connection without the corresponding PRIVATE key exactly?