4 ms·
But so, basically, it's a root certificate that signs the key…
by LtWorf 4y ago
But so, basically, it's a root certificate that signs the key…
- woodruffw 4y agoIt’s very close to the existing PKI ecosystem for TLS: the CA is presented a possession proof for the locally held private key, and mints a signing certificate for it. There is no singular “root certificate”: there’s a trust root for the CA, a separate root for the transparency log, etc.
- di 4y agoNope. The private key is generated within the client each time a signing event occurs, and that's what is used to sign the artifact. It doesn't come from the certificate. The certificate just binds the public key to the identity at a given point in time, in a public way. This certificate is generated every time you sign something, and is put in the transparency log. There's a walkthrough of the process here that might be helpful: https://www.youtube.com/watch?v=jdf-gNYg0fw&t=494s https://www.youtube.com/watch?v=jdf-gNYg0fw&t=494s