3 ms·
That's not at all how Let's Encrypt or any HTTPS CAs work (or have ever worked). You send them a certificate signing request, and they respond with a signed cer
by ronsor 5y ago
That's not at all how Let's Encrypt or any HTTPS CAs work (or have ever worked). You send them a certificate signing request, and they respond with a signed certificate. You never give them your private key.
- hanniabu 5y agoNever heard of a back door? There can be master private keys.
- XorNot 5y agoFunctionally irrelevant to your browser though without HSTS: being able to MITM specific targets with correctly signed certificates would be extremely useful.
- KirillPanov 5y agoIf they issued a malicious certificate they would not be able to hide it. Certificate Transparency logs are now mandatory for all TLS certificates: https://en.m.wikipedia.org/wiki/Certificate_Transparency https://en.m.wikipedia.org/wiki/Certificate_Transparency The log is like a git hash-chain: you can never erase the past without affecting the whole chain after the erasure. If you want hidden backdoors, put them in hardware, not software. Chips are the best place.