3 ms·
Most places where you can authenticate with SSL client certs allow you to add your own self-signed certificate and authenticate using that. All the validation y
by xnyhps 13y ago
Most places where you can authenticate with SSL client certs allow you to add your own self-signed certificate and authenticate using that. All the validation you need is to check wether the cert is in the user's list. You can only forge that by stealing the private key.
There's really no reason to only allow CA signed client certs.
- booyahdog 13y agoThats not the question. The question is how is a cert validated properly? For example, you can have a parent CA certificate and iOS (just as one example) will accept the child cert no questions asked. Also if you forego CA and self sign, how do you verify your OWN cert? How? A proxy can just pass it through to your client if you use server trust. So you have a problem, the OS cant validate your cert and you have limited means to validate your own cert. All you know is you encrypted something. Any joe can buy a CA cert and fool iOS (just as an example) but not only that, the govt can easily forge CA keys and forge certs. So then what do you do? Your server cert can easily be forged or replayed through a proxy.
- booyahdog 13y agoI dont mean to be rude, or create doubt, but you must realize that SSL is completely insecure.