3 ms·
How does the certificate? If you already have to do the TLS handshake it doesn't change anything.
by msgodel 1y ago
How does the certificate? If you already have to do the TLS handshake it doesn't change anything.
- Dylan16807 1y agoA verified certificate lets you know you didn't handshake with an attacker in the middle.
- msgodel 1y agoLet me rephrase that: How is the CA supposed to know they didn't handshake with an attacker? All they have is the IP, there's no identity to check like with DNS.
- Dylan16807 1y agoThe CA connects to the IP from multiple different points across the internet. If you can convince all of them, you almost certainly do control the IP. You as a normal client don't do that. Your computer can be fooled by very easy local spoofs. And for what it's worth, taking over the IP would also let you get a DNS-based certificate, so those actually have more weak points.