3 ms·
All the certificate verifies is that the server you are connected to actually belongs to someone who controls the domain that it's hosted at. You can get one i
by TheCoelacanth 6y ago
All the certificate verifies is that the server you are connected to actually belongs to someone who controls the domain that it's hosted at.
You can get one issued for free just by demonstrating that you actually control the domain.
- ktpsns 6y agoThere is so much on TLS beyond Let's Encrypt. For instance, TLS allows user certificates to authenticate the user, not the server. This works a bit like SSH passwordless login (thanks to key authentication). This technique only works if the site operator also controls a CA which the browser accepts. Companies can easily install self-signed certs to do so, but on the wild web that's quite difficult. So yeah, even today there are use cases for custom CAs.
- TheCoelacanth 6y agoI'm aware that client certificates exist. I'm not aware of anyone actually using them. It also doesn't really have the problem of "unapproved" sites. You are already installing a certificate on the client. It's no extra work to add another trusted CA at the same time.