3 ms·
I consider managing a CA at home to be a _much_ bigger security risk than having HTTP traffic on my home LAN.
by NegativeK 3y ago
I consider managing a CA at home to be a _much_ bigger security risk than having HTTP traffic on my home LAN.
- ownagefool 3y agoThis doesn't make sense unless you use the CA for something in addition / more critical for HTTP. Sure, you could leak said CA, but it's only going to leave you in the same position as HTTP.
- NegativeK 3y agoYou can generate CA certs that are only allowed to sign certs for specific domains, but _nothing_ respects that self limitation. That means that if the CA keys get out, someone could use it to sign their own cert for google.com, [mybank].com, or [mypasswordmanager].com. Every device with my CA cert on it will trust those.
- ownagefool 3y agoThat's a fair point.
- janosdebugs 3y agoThat may be so, but I from the perspective of a few billion people using Chrome, the percentage of people that need to and should access something on the local network without encryption is probably a few magnitudes smaller than the same audience on Hacker News.
- GoblinSlayer 3y agoSign a certificate expiring in 2070 and delete the CA key. That's all management you need. And if anyone has access to your disk, it's much easier for them to add you their CA certificate than search for your CA key.