3 ms·
It's not SSL per se, but the Certification Authority system that is weak. If you get one of the root CA certs, you can make any SSL cert a valid SSL cert for an
by rmc 14y ago
It's not SSL per se, but the Certification Authority system that is weak. If you get one of the root CA certs, you can make any SSL cert a valid SSL cert for any domain name.
- Egregore 14y agoIt's correct that if root CA is compromised you can make fakes. To protect against this attack browsers should warn when certificate changes, there even is a long standing bug for firefox in mozilla: https://bugzilla.mozilla.org/show_bug.cgi?id=471798 https://bugzilla.mozilla.org/show_bug.cgi?id=471798