5 ms·

stop treating self-issued certs as inherently insecure, please.

• judge2020 5y ago
  This is impossible since you can't be certain that a self signed cert is issued by $isp or $government versus the website owner.
  • arpa 5y ago
    if I issued the cert myself, for sure I can ;)
    • gscott 5y ago
      What really is the difference between a $5 secure certificate from ssls.com, a self-signed cert, a $60 godaddy cert, and a lets encrypt ssl. Just about nothing right? So why not trust self-signed certs.
      • judge2020 5y ago
        Everything other than a self signed certificate has technical checks requiring that the person requesting issuance of the domain actually has control over the domain via dns or http challenges. Without those you (or your ISP or government) could self-issue accounts.google.com (or api.stripe.com or bankofamerica.com) and MITM people to steal information that otherwise would be presumed private to middlemen.