5 ms·
The point of certificates is not to encrypt the traffic, but rather to verify that the server you are talking to is who they claim they are. The server showing
by pitkali 4y ago
The point of certificates is not to encrypt the traffic, but rather to verify that the server you are talking to is who they claim they are. The server showing you their certificate is like you logging into an SSH session, which I've been doing for a long time with a certificate as well, actually.
- BurnGpuBurn 4y agoIn my browser it is either/or though. I can have encryption and verification, or none of those. Technically it would be feasable to have encryption without verification, and thus without CA's. Why isn't that an option?
- Avamander 4y agoBecause encryption without verification is practically useless.
- SAI_Peregrinus 4y agoMore specifically, because encryption without verification allows for MITM and other chosen-ciphertext attacks which trivially break the confidentiality provided by the encryption. Encryption needs entity authentication (verifying who you're talking to), data authentication (verifying that the ciphertext has been created by one of the parties in the communication), and a cipher to provide confidentiality in practice.
- mort96 4y agoYou can do what you want by creating your own self-signed certificates. It's not that hard, just a couple of openssl commands. Browsers will throw up a big scary warning that the certificate can't be verified (as you'd expect), but most browsers let you click through that warning, and you get encrypted but unverified traffic.
- benlivengood 4y agoYou can set up your clients and servers to prefer and/or allow the NULL cipher.