2 ms·

All HTTPS does is ensure security between your client and the server with the private key of the certificate. You typically trust certificate signers (globalsig

All HTTPS does is ensure security between your client and the server with the private key of the certificate. You typically trust certificate signers (globalsign, letsencrypt, etc) who have their own policies for ensuring who gets a certificate (in LE's case you have to prove ownership of the domain) If a domain owner gets a certificate and gives it, and a private key, to a third party, then that's their business.

tetha 6y ago
> All HTTPS does is ensure security between your client and the server with the private key of the certificate. Just for completeness, HTTPs does not necessarily guarantee you are connected to the right server. This depends on the CAs you trust. For example, larger enterprises commonly inject their own CA into their workstations in order to prevent loss of sensitive data. This allows SSL inspection proxies to terminate all SSL connections with a valid, trusted certificate from the perspective of that workstation. .