X509 cert retrievals is predominantly done over HTTP, because otherwise you’d need X509 to implement X509. It may sound “insecure”, but if you can’t trust X509

X509 cert retrievals is predominantly done over HTTP, because otherwise you’d need X509 to implement X509. It may sound “insecure”, but if you can’t trust X509 without HTTPS, you effectively can’t trust either X509 or HTTPS. This is why we have layers in software. We trust X509 because of fundamental math. Therefore we trust HTTPS built on X509. Therefore we trust systems built on HTTPS. Everything is perfectly fine.