3 ms·
Installing trust store certificates for these purposes is asking for trouble. Sure, if the private key is unique per installation it theoretically should be fin
by rezonant 7y ago
Installing trust store certificates for these purposes is asking for trouble. Sure, if the private key is unique per installation it theoretically should be fine, but in reality it can be hard to gather enough entropy to be satisfiably unpredictable, and it's very easy to get this wrong. It's worth noting that there isn't a solid way to limit your CA certificate in the trust-store to the domains you intend to use it with https://security.stackexchange.com/questions/31376/can-i-restrict-a-certification-authority-to-signing-certain-domains-only https://security.stackexchange.com/questions/31376/can-i-res...
- tgsovlerkhgsel 7y agoCan't you just install a specific self-signed certificate for a single domain instead of a CA certificate?
- vbezhenar 7y agoYes, you can and you should do that.
- mappu 7y ago> in reality it can be hard to gather enough entropy to be satisfiably unpredictable I think this is a myth, especially on desktop/laptop PCs - a few hundred bytes of entropy at system boot initialize the kernel CSPRNG, which can then generate countless gigabytes of cryptographic-quality randomness on demand.