3 ms·
> Using CAs to authenticate clients is subject to the same attack. You don't need to use a publicly available CA to verify client-side certificates. The serve
by u801e 7y ago
> Using CAs to authenticate clients is subject to the same attack.
You don't need to use a publicly available CA to verify client-side certificates. The server could use its own internal CA to sign CSRs from clients and send the reslting certificate back to the client via email or some other means.
- PeterisP 7y agoIn which case the MITM will be unable to connect to the server because it won't have the certificate (that you sent via email or some other means), so the service simply won't work. That's the whole point, you either go through MITM or not at all.
- deleted 7y ago[deleted]