3 ms·
What's the difference between this and an in-house centrally managed CA?
by mawise 5y ago
What's the difference between this and an in-house centrally managed CA?
- viraptor 5y agoThis is an in-house centrally managed CA.
- thayne 5y agoI'm guessing you specifically mean a SSL/TLS CA? This is for PGP keys instead of X.509 certificates.
- georgyo 5y agoWhile you're 100% correct, some organizations use S/MIME to send signed and encrypted emails with their TLS x.509 certs signed by their companies TLS CA. But you can also get your X.509 cert signed by a public CA and then anyone on the internet can verify your S/MIME signed email. In practice I've only seen this in government and government contractors, but I'm sure it is done else where. The flaws with the above approach. 1. Smaller adoption that OpenPGP 2. You normally cannot encrypt outside your organization because their is no method for key discovery. Though if you received a signed message in the past, I believe you can use that. 3. Using pubic CA infrastructure means any trusted Public CA can impersonate anyone. The OpenPGP CA solves all these problems because pgp Web Key Directory (WKD) and that is automatically scoped to domains.
- georgyo 5y agoI'll also add the the federal US government makes extensive use of personal TLS certificates, and they store the private key material on a smartcard embedded inside your ID. Your cert is used from everything from signing and decrypting emails to gaining access to sites to signing attestations that something happened.
- pharaohgeek 5y agoPartially true. TLS stands for "Transport Layer Security". TLS certificates are used on servers to encrypt communication. The certificates on the smartcard are used for digital signatures, encryption, and authentication. All of those certificates follow the X.509 certificate standard.